Analysis
-
max time kernel
160s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:05
Behavioral task
behavioral1
Sample
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe
Resource
win10v2004-20221111-en
General
-
Target
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe
-
Size
255KB
-
MD5
1cfd38e26a69b5131995dba56e0fdaeb
-
SHA1
07aa7e5b70a48346043873cf61460e251146e0aa
-
SHA256
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0
-
SHA512
b5f8048843937307f60302062b6e1b109bbcc735eb83555e24c728867071b65441675f8e4587993dbea7cc31315c14a0d7633a205cd96b37fb1d3bc139bf9b84
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJo:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIH
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
nankmmllms.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" nankmmllms.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
nankmmllms.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nankmmllms.exe -
Processes:
nankmmllms.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" nankmmllms.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
nankmmllms.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nankmmllms.exe -
Executes dropped EXE 5 IoCs
Processes:
nankmmllms.exenrminqafcauudmu.exeqxomngfo.exebbharmxjuwhwb.exeqxomngfo.exepid process 504 nankmmllms.exe 2580 nrminqafcauudmu.exe 1464 qxomngfo.exe 1572 bbharmxjuwhwb.exe 2192 qxomngfo.exe -
Processes:
resource yara_rule behavioral2/memory/1004-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\nankmmllms.exe upx C:\Windows\SysWOW64\nankmmllms.exe upx C:\Windows\SysWOW64\nrminqafcauudmu.exe upx C:\Windows\SysWOW64\nrminqafcauudmu.exe upx C:\Windows\SysWOW64\qxomngfo.exe upx C:\Windows\SysWOW64\qxomngfo.exe upx behavioral2/memory/504-142-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\bbharmxjuwhwb.exe upx behavioral2/memory/1464-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2580-144-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\bbharmxjuwhwb.exe upx behavioral2/memory/1572-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\qxomngfo.exe upx behavioral2/memory/1004-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2192-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe upx behavioral2/memory/2580-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1464-168-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/504-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1572-169-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2192-170-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe -
Processes:
nankmmllms.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" nankmmllms.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
nrminqafcauudmu.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run nrminqafcauudmu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\drmoqyiq = "nankmmllms.exe" nrminqafcauudmu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qzgspbie = "nrminqafcauudmu.exe" nrminqafcauudmu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "bbharmxjuwhwb.exe" nrminqafcauudmu.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
qxomngfo.exeqxomngfo.exenankmmllms.exedescription ioc process File opened (read-only) \??\q: qxomngfo.exe File opened (read-only) \??\x: qxomngfo.exe File opened (read-only) \??\b: qxomngfo.exe File opened (read-only) \??\s: qxomngfo.exe File opened (read-only) \??\u: nankmmllms.exe File opened (read-only) \??\f: qxomngfo.exe File opened (read-only) \??\j: qxomngfo.exe File opened (read-only) \??\z: qxomngfo.exe File opened (read-only) \??\p: nankmmllms.exe File opened (read-only) \??\h: qxomngfo.exe File opened (read-only) \??\r: nankmmllms.exe File opened (read-only) \??\e: qxomngfo.exe File opened (read-only) \??\k: qxomngfo.exe File opened (read-only) \??\h: nankmmllms.exe File opened (read-only) \??\j: nankmmllms.exe File opened (read-only) \??\x: nankmmllms.exe File opened (read-only) \??\k: qxomngfo.exe File opened (read-only) \??\t: qxomngfo.exe File opened (read-only) \??\h: qxomngfo.exe File opened (read-only) \??\j: qxomngfo.exe File opened (read-only) \??\s: qxomngfo.exe File opened (read-only) \??\a: qxomngfo.exe File opened (read-only) \??\r: qxomngfo.exe File opened (read-only) \??\l: qxomngfo.exe File opened (read-only) \??\p: qxomngfo.exe File opened (read-only) \??\f: nankmmllms.exe File opened (read-only) \??\y: nankmmllms.exe File opened (read-only) \??\p: qxomngfo.exe File opened (read-only) \??\y: qxomngfo.exe File opened (read-only) \??\e: qxomngfo.exe File opened (read-only) \??\g: qxomngfo.exe File opened (read-only) \??\t: qxomngfo.exe File opened (read-only) \??\a: nankmmllms.exe File opened (read-only) \??\i: nankmmllms.exe File opened (read-only) \??\q: nankmmllms.exe File opened (read-only) \??\z: nankmmllms.exe File opened (read-only) \??\g: qxomngfo.exe File opened (read-only) \??\f: qxomngfo.exe File opened (read-only) \??\q: qxomngfo.exe File opened (read-only) \??\k: nankmmllms.exe File opened (read-only) \??\b: qxomngfo.exe File opened (read-only) \??\z: qxomngfo.exe File opened (read-only) \??\y: qxomngfo.exe File opened (read-only) \??\u: qxomngfo.exe File opened (read-only) \??\s: nankmmllms.exe File opened (read-only) \??\w: qxomngfo.exe File opened (read-only) \??\n: qxomngfo.exe File opened (read-only) \??\u: qxomngfo.exe File opened (read-only) \??\i: qxomngfo.exe File opened (read-only) \??\v: qxomngfo.exe File opened (read-only) \??\w: qxomngfo.exe File opened (read-only) \??\o: nankmmllms.exe File opened (read-only) \??\v: nankmmllms.exe File opened (read-only) \??\w: nankmmllms.exe File opened (read-only) \??\m: qxomngfo.exe File opened (read-only) \??\n: qxomngfo.exe File opened (read-only) \??\x: qxomngfo.exe File opened (read-only) \??\l: nankmmllms.exe File opened (read-only) \??\b: nankmmllms.exe File opened (read-only) \??\g: nankmmllms.exe File opened (read-only) \??\m: nankmmllms.exe File opened (read-only) \??\a: qxomngfo.exe File opened (read-only) \??\i: qxomngfo.exe File opened (read-only) \??\o: qxomngfo.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
nankmmllms.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" nankmmllms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" nankmmllms.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1004-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/504-142-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1464-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2580-144-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1572-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1004-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2192-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2580-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1464-168-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/504-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1572-169-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2192-170-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exenankmmllms.exedescription ioc process File created C:\Windows\SysWOW64\nankmmllms.exe 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe File created C:\Windows\SysWOW64\nrminqafcauudmu.exe 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe File opened for modification C:\Windows\SysWOW64\nrminqafcauudmu.exe 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe File opened for modification C:\Windows\SysWOW64\qxomngfo.exe 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe File opened for modification C:\Windows\SysWOW64\nankmmllms.exe 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe File created C:\Windows\SysWOW64\qxomngfo.exe 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe File created C:\Windows\SysWOW64\bbharmxjuwhwb.exe 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe File opened for modification C:\Windows\SysWOW64\bbharmxjuwhwb.exe 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll nankmmllms.exe -
Drops file in Program Files directory 14 IoCs
Processes:
qxomngfo.exeqxomngfo.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qxomngfo.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qxomngfo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal qxomngfo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qxomngfo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qxomngfo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal qxomngfo.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qxomngfo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal qxomngfo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qxomngfo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qxomngfo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qxomngfo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal qxomngfo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe qxomngfo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe qxomngfo.exe -
Drops file in Windows directory 3 IoCs
Processes:
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
nankmmllms.exe469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg nankmmllms.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33342C799C2783546A3176DD70532CAB7D8365DA" 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc nankmmllms.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs nankmmllms.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh nankmmllms.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" nankmmllms.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" nankmmllms.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" nankmmllms.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" nankmmllms.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBF9CDF960F190837E3A40869A3997B08C028A4214023CE1CA42ED09D6" 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECAB05B47E139EF53BFBAD53293D7C9" 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E88FFFC482885699041D72A7E9DBDE7E6375840674F6242D7ED" 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat nankmmllms.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf nankmmllms.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" nankmmllms.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" nankmmllms.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F568B7FE6921AED108D1A78A09906B" 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1938C77B15E5DBC3B9BB7CE6ED9734CC" 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2772 WINWORD.EXE 2772 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exenankmmllms.exenrminqafcauudmu.exeqxomngfo.exebbharmxjuwhwb.exepid process 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 1464 qxomngfo.exe 1464 qxomngfo.exe 1464 qxomngfo.exe 1464 qxomngfo.exe 1464 qxomngfo.exe 1464 qxomngfo.exe 1464 qxomngfo.exe 1464 qxomngfo.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 2580 nrminqafcauudmu.exe 2580 nrminqafcauudmu.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exenankmmllms.exenrminqafcauudmu.exeqxomngfo.exebbharmxjuwhwb.exeqxomngfo.exepid process 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 2580 nrminqafcauudmu.exe 1464 qxomngfo.exe 2580 nrminqafcauudmu.exe 1464 qxomngfo.exe 2580 nrminqafcauudmu.exe 1464 qxomngfo.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 2192 qxomngfo.exe 2192 qxomngfo.exe 2192 qxomngfo.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exenankmmllms.exenrminqafcauudmu.exeqxomngfo.exebbharmxjuwhwb.exeqxomngfo.exepid process 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe 504 nankmmllms.exe 504 nankmmllms.exe 504 nankmmllms.exe 2580 nrminqafcauudmu.exe 1464 qxomngfo.exe 2580 nrminqafcauudmu.exe 1464 qxomngfo.exe 2580 nrminqafcauudmu.exe 1464 qxomngfo.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 1572 bbharmxjuwhwb.exe 2192 qxomngfo.exe 2192 qxomngfo.exe 2192 qxomngfo.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2772 WINWORD.EXE 2772 WINWORD.EXE 2772 WINWORD.EXE 2772 WINWORD.EXE 2772 WINWORD.EXE 2772 WINWORD.EXE 2772 WINWORD.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exenrminqafcauudmu.exenankmmllms.exedescription pid process target process PID 1004 wrote to memory of 504 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe nankmmllms.exe PID 1004 wrote to memory of 504 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe nankmmllms.exe PID 1004 wrote to memory of 504 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe nankmmllms.exe PID 1004 wrote to memory of 2580 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe nrminqafcauudmu.exe PID 1004 wrote to memory of 2580 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe nrminqafcauudmu.exe PID 1004 wrote to memory of 2580 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe nrminqafcauudmu.exe PID 1004 wrote to memory of 1464 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe qxomngfo.exe PID 1004 wrote to memory of 1464 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe qxomngfo.exe PID 1004 wrote to memory of 1464 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe qxomngfo.exe PID 1004 wrote to memory of 1572 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe bbharmxjuwhwb.exe PID 1004 wrote to memory of 1572 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe bbharmxjuwhwb.exe PID 1004 wrote to memory of 1572 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe bbharmxjuwhwb.exe PID 2580 wrote to memory of 3056 2580 nrminqafcauudmu.exe cmd.exe PID 2580 wrote to memory of 3056 2580 nrminqafcauudmu.exe cmd.exe PID 2580 wrote to memory of 3056 2580 nrminqafcauudmu.exe cmd.exe PID 504 wrote to memory of 2192 504 nankmmllms.exe qxomngfo.exe PID 504 wrote to memory of 2192 504 nankmmllms.exe qxomngfo.exe PID 504 wrote to memory of 2192 504 nankmmllms.exe qxomngfo.exe PID 1004 wrote to memory of 2772 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe WINWORD.EXE PID 1004 wrote to memory of 2772 1004 469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe WINWORD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe"C:\Users\Admin\AppData\Local\Temp\469fd656707a9e995050780b15d1c9c05f7e7850f18f7ece3c9f9b8bfe3177f0.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\nankmmllms.exenankmmllms.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\qxomngfo.exeC:\Windows\system32\qxomngfo.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192 -
C:\Windows\SysWOW64\nrminqafcauudmu.exenrminqafcauudmu.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\cmd.execmd.exe /c bbharmxjuwhwb.exe3⤵PID:3056
-
C:\Windows\SysWOW64\qxomngfo.exeqxomngfo.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1464 -
C:\Windows\SysWOW64\bbharmxjuwhwb.exebbharmxjuwhwb.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1572 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2772
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
255KB
MD5f3de855f108d04db31a5f80cfa0cf3ed
SHA1b1bebd60824003dd33645be63d8b28421cfb7a1b
SHA25631902e89ca9fb8b82770ede367d9b28a15aa8279d2cb1f5a9d999c6d60204e34
SHA5120a010d39d9680ba79092aa208a26e08caae022f9b575c9d8d50ed2b26ef367ad2d9fe918d7b141b903b89a8f61282857e826c07d020ff03faef69437e2122829
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD5ba1644a389752387637af1ab510a6b50
SHA1a813739f7e22229b1913470609e0d279a8a58d9a
SHA25612b88c058a3358051333294607cb4b17757fbe8f38f22c4a7e4405e5aa463687
SHA5123326cd6ca6281a565db3c9e73cb2b3898e78386f03b5fba737c3867720b6b65660c934df4f952cfa773eb20f1b8834125b43b2b703b455759c91423ca4ba312f
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD5ba1644a389752387637af1ab510a6b50
SHA1a813739f7e22229b1913470609e0d279a8a58d9a
SHA25612b88c058a3358051333294607cb4b17757fbe8f38f22c4a7e4405e5aa463687
SHA5123326cd6ca6281a565db3c9e73cb2b3898e78386f03b5fba737c3867720b6b65660c934df4f952cfa773eb20f1b8834125b43b2b703b455759c91423ca4ba312f
-
C:\Windows\SysWOW64\bbharmxjuwhwb.exeFilesize
255KB
MD57709d90d0e17408d2bc3eaf8404dfb8f
SHA1a12563d5cb5c054220cfab3661daeec1871269e8
SHA256273ddade533e3a9e58fcc565ed62fb95cd2035dbf7bffa5cc99c8fb20fc62d53
SHA512913abec0112f9999efa0995868b4669ea503a656fbb2347bc626c2fc7bb6548c340678491adc0d5219bdfbb144fedad1242f790939e89cbfa194bdca6da93e1c
-
C:\Windows\SysWOW64\bbharmxjuwhwb.exeFilesize
255KB
MD57709d90d0e17408d2bc3eaf8404dfb8f
SHA1a12563d5cb5c054220cfab3661daeec1871269e8
SHA256273ddade533e3a9e58fcc565ed62fb95cd2035dbf7bffa5cc99c8fb20fc62d53
SHA512913abec0112f9999efa0995868b4669ea503a656fbb2347bc626c2fc7bb6548c340678491adc0d5219bdfbb144fedad1242f790939e89cbfa194bdca6da93e1c
-
C:\Windows\SysWOW64\nankmmllms.exeFilesize
255KB
MD5a8d0eef9e58a56c53a6498cd93d0b8a8
SHA107b825b0efc74b7059846e5ccae6e4c436a7afc8
SHA256512c519f080b168dfffc89446f0ee3ed64b857a2d91a8610e43e36f25c450523
SHA51224b760debf1e6c73af5156d289e0292319b57ac07f8356cf50be984ecb753aee7c81c8a4709df39aa4e7f0adc571e8970fa0381c377517ec5f1b905348ccbb29
-
C:\Windows\SysWOW64\nankmmllms.exeFilesize
255KB
MD5a8d0eef9e58a56c53a6498cd93d0b8a8
SHA107b825b0efc74b7059846e5ccae6e4c436a7afc8
SHA256512c519f080b168dfffc89446f0ee3ed64b857a2d91a8610e43e36f25c450523
SHA51224b760debf1e6c73af5156d289e0292319b57ac07f8356cf50be984ecb753aee7c81c8a4709df39aa4e7f0adc571e8970fa0381c377517ec5f1b905348ccbb29
-
C:\Windows\SysWOW64\nrminqafcauudmu.exeFilesize
255KB
MD5496ed9eb28eab7144a101ac4e27613be
SHA1f0cefd9362ed5fc7e1df2497bc9c86487f2bf105
SHA256a6925010df9cb14d8d2abc18fab419ec63b4aa7becc94a0445983c67381f7fec
SHA51285acd23a133a8dfc62033bfc6448077606f19ef07b4fd4454ceca3baef9b15c1edfae67f7e17d41318ce1c64ff8501f6285495f9dd2f008dfa46f235ae30ed46
-
C:\Windows\SysWOW64\nrminqafcauudmu.exeFilesize
255KB
MD5496ed9eb28eab7144a101ac4e27613be
SHA1f0cefd9362ed5fc7e1df2497bc9c86487f2bf105
SHA256a6925010df9cb14d8d2abc18fab419ec63b4aa7becc94a0445983c67381f7fec
SHA51285acd23a133a8dfc62033bfc6448077606f19ef07b4fd4454ceca3baef9b15c1edfae67f7e17d41318ce1c64ff8501f6285495f9dd2f008dfa46f235ae30ed46
-
C:\Windows\SysWOW64\qxomngfo.exeFilesize
255KB
MD5b8d2688df8dda25be178f1b28e5cc7cf
SHA165322825f50a3002401bf523ffa21a0d750f9a75
SHA256c8ae7a2e48fbd24168a42f8376a24e3a3fc46eeac86b90bf6336c2c40d9e998b
SHA5120955b4018a33cfd3936e6d1784dd11b4c30055d8fdfa9e537ef014fbd5c9734ac332e374587e1226603435aa1ef3fc076e0fe6b4f5d2e547e4f4d9a0fe2d8388
-
C:\Windows\SysWOW64\qxomngfo.exeFilesize
255KB
MD5b8d2688df8dda25be178f1b28e5cc7cf
SHA165322825f50a3002401bf523ffa21a0d750f9a75
SHA256c8ae7a2e48fbd24168a42f8376a24e3a3fc46eeac86b90bf6336c2c40d9e998b
SHA5120955b4018a33cfd3936e6d1784dd11b4c30055d8fdfa9e537ef014fbd5c9734ac332e374587e1226603435aa1ef3fc076e0fe6b4f5d2e547e4f4d9a0fe2d8388
-
C:\Windows\SysWOW64\qxomngfo.exeFilesize
255KB
MD5b8d2688df8dda25be178f1b28e5cc7cf
SHA165322825f50a3002401bf523ffa21a0d750f9a75
SHA256c8ae7a2e48fbd24168a42f8376a24e3a3fc46eeac86b90bf6336c2c40d9e998b
SHA5120955b4018a33cfd3936e6d1784dd11b4c30055d8fdfa9e537ef014fbd5c9734ac332e374587e1226603435aa1ef3fc076e0fe6b4f5d2e547e4f4d9a0fe2d8388
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
memory/504-142-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/504-167-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/504-133-0x0000000000000000-mapping.dmp
-
memory/1004-132-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1004-153-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1464-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1464-168-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1464-139-0x0000000000000000-mapping.dmp
-
memory/1572-143-0x0000000000000000-mapping.dmp
-
memory/1572-169-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1572-149-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2192-150-0x0000000000000000-mapping.dmp
-
memory/2192-170-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2192-154-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2580-136-0x0000000000000000-mapping.dmp
-
memory/2580-144-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2580-166-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2772-159-0x00007FFB7B650000-0x00007FFB7B660000-memory.dmpFilesize
64KB
-
memory/2772-152-0x0000000000000000-mapping.dmp
-
memory/2772-164-0x00007FFB79320000-0x00007FFB79330000-memory.dmpFilesize
64KB
-
memory/2772-160-0x00007FFB79320000-0x00007FFB79330000-memory.dmpFilesize
64KB
-
memory/2772-158-0x00007FFB7B650000-0x00007FFB7B660000-memory.dmpFilesize
64KB
-
memory/2772-156-0x00007FFB7B650000-0x00007FFB7B660000-memory.dmpFilesize
64KB
-
memory/2772-157-0x00007FFB7B650000-0x00007FFB7B660000-memory.dmpFilesize
64KB
-
memory/2772-155-0x00007FFB7B650000-0x00007FFB7B660000-memory.dmpFilesize
64KB
-
memory/2772-172-0x00007FFB7B650000-0x00007FFB7B660000-memory.dmpFilesize
64KB
-
memory/2772-173-0x00007FFB7B650000-0x00007FFB7B660000-memory.dmpFilesize
64KB
-
memory/2772-174-0x00007FFB7B650000-0x00007FFB7B660000-memory.dmpFilesize
64KB
-
memory/2772-175-0x00007FFB7B650000-0x00007FFB7B660000-memory.dmpFilesize
64KB
-
memory/3056-148-0x0000000000000000-mapping.dmp