Analysis
-
max time kernel
169s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:03
Behavioral task
behavioral1
Sample
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
Resource
win10v2004-20221111-en
General
-
Target
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
-
Size
255KB
-
MD5
91fdc5866a1a2beb0c0264724e95c533
-
SHA1
de7c57622c61abe3fdc8c0b60e974fe469f08627
-
SHA256
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6
-
SHA512
9697b99751f23c6f0f2aa73125a78fd99d4e5c2b9a63a392378fd11aafb1c529edfebd3d00172af30453f3b8085f5b4ad81e2cfe3de1cfee44fd6d91b02b83d4
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIo
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
tgqlplvvjw.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tgqlplvvjw.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
tgqlplvvjw.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tgqlplvvjw.exe -
Processes:
tgqlplvvjw.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tgqlplvvjw.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
tgqlplvvjw.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tgqlplvvjw.exe -
Executes dropped EXE 5 IoCs
Processes:
tgqlplvvjw.exevgstobfjhlujqum.exepyogxjrx.execeiblppwmyoyn.exepyogxjrx.exepid process 1604 tgqlplvvjw.exe 4252 vgstobfjhlujqum.exe 748 pyogxjrx.exe 2676 ceiblppwmyoyn.exe 3668 pyogxjrx.exe -
Processes:
resource yara_rule behavioral2/memory/1624-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\tgqlplvvjw.exe upx C:\Windows\SysWOW64\tgqlplvvjw.exe upx C:\Windows\SysWOW64\vgstobfjhlujqum.exe upx C:\Windows\SysWOW64\vgstobfjhlujqum.exe upx C:\Windows\SysWOW64\pyogxjrx.exe upx C:\Windows\SysWOW64\pyogxjrx.exe upx C:\Windows\SysWOW64\ceiblppwmyoyn.exe upx C:\Windows\SysWOW64\ceiblppwmyoyn.exe upx behavioral2/memory/1604-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4252-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/748-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2676-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1624-150-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\pyogxjrx.exe upx behavioral2/memory/3668-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1604-162-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4252-163-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/748-164-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2676-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3668-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe -
Processes:
tgqlplvvjw.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tgqlplvvjw.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vgstobfjhlujqum.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run vgstobfjhlujqum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dfodjxtt = "tgqlplvvjw.exe" vgstobfjhlujqum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\simddler = "vgstobfjhlujqum.exe" vgstobfjhlujqum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ceiblppwmyoyn.exe" vgstobfjhlujqum.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
pyogxjrx.exetgqlplvvjw.exepyogxjrx.exedescription ioc process File opened (read-only) \??\t: pyogxjrx.exe File opened (read-only) \??\u: tgqlplvvjw.exe File opened (read-only) \??\e: pyogxjrx.exe File opened (read-only) \??\f: pyogxjrx.exe File opened (read-only) \??\j: pyogxjrx.exe File opened (read-only) \??\t: pyogxjrx.exe File opened (read-only) \??\k: tgqlplvvjw.exe File opened (read-only) \??\o: pyogxjrx.exe File opened (read-only) \??\f: pyogxjrx.exe File opened (read-only) \??\g: pyogxjrx.exe File opened (read-only) \??\j: pyogxjrx.exe File opened (read-only) \??\p: pyogxjrx.exe File opened (read-only) \??\r: pyogxjrx.exe File opened (read-only) \??\b: tgqlplvvjw.exe File opened (read-only) \??\v: pyogxjrx.exe File opened (read-only) \??\v: tgqlplvvjw.exe File opened (read-only) \??\a: pyogxjrx.exe File opened (read-only) \??\m: pyogxjrx.exe File opened (read-only) \??\s: pyogxjrx.exe File opened (read-only) \??\y: pyogxjrx.exe File opened (read-only) \??\i: pyogxjrx.exe File opened (read-only) \??\k: pyogxjrx.exe File opened (read-only) \??\n: tgqlplvvjw.exe File opened (read-only) \??\x: tgqlplvvjw.exe File opened (read-only) \??\h: pyogxjrx.exe File opened (read-only) \??\i: pyogxjrx.exe File opened (read-only) \??\f: tgqlplvvjw.exe File opened (read-only) \??\m: pyogxjrx.exe File opened (read-only) \??\q: pyogxjrx.exe File opened (read-only) \??\l: pyogxjrx.exe File opened (read-only) \??\q: pyogxjrx.exe File opened (read-only) \??\x: pyogxjrx.exe File opened (read-only) \??\y: pyogxjrx.exe File opened (read-only) \??\b: pyogxjrx.exe File opened (read-only) \??\p: pyogxjrx.exe File opened (read-only) \??\r: pyogxjrx.exe File opened (read-only) \??\u: pyogxjrx.exe File opened (read-only) \??\w: pyogxjrx.exe File opened (read-only) \??\z: tgqlplvvjw.exe File opened (read-only) \??\u: pyogxjrx.exe File opened (read-only) \??\w: pyogxjrx.exe File opened (read-only) \??\h: pyogxjrx.exe File opened (read-only) \??\a: tgqlplvvjw.exe File opened (read-only) \??\m: tgqlplvvjw.exe File opened (read-only) \??\w: tgqlplvvjw.exe File opened (read-only) \??\z: pyogxjrx.exe File opened (read-only) \??\l: pyogxjrx.exe File opened (read-only) \??\g: tgqlplvvjw.exe File opened (read-only) \??\e: pyogxjrx.exe File opened (read-only) \??\e: tgqlplvvjw.exe File opened (read-only) \??\l: tgqlplvvjw.exe File opened (read-only) \??\r: tgqlplvvjw.exe File opened (read-only) \??\k: pyogxjrx.exe File opened (read-only) \??\o: pyogxjrx.exe File opened (read-only) \??\p: tgqlplvvjw.exe File opened (read-only) \??\g: pyogxjrx.exe File opened (read-only) \??\s: pyogxjrx.exe File opened (read-only) \??\h: tgqlplvvjw.exe File opened (read-only) \??\i: tgqlplvvjw.exe File opened (read-only) \??\v: pyogxjrx.exe File opened (read-only) \??\a: pyogxjrx.exe File opened (read-only) \??\n: pyogxjrx.exe File opened (read-only) \??\o: tgqlplvvjw.exe File opened (read-only) \??\s: tgqlplvvjw.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
tgqlplvvjw.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" tgqlplvvjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" tgqlplvvjw.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1624-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1604-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4252-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/748-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2676-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1624-150-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3668-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1604-162-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4252-163-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/748-164-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2676-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3668-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exetgqlplvvjw.exedescription ioc process File created C:\Windows\SysWOW64\ceiblppwmyoyn.exe 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe File opened for modification C:\Windows\SysWOW64\ceiblppwmyoyn.exe 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll tgqlplvvjw.exe File created C:\Windows\SysWOW64\tgqlplvvjw.exe 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe File opened for modification C:\Windows\SysWOW64\tgqlplvvjw.exe 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe File opened for modification C:\Windows\SysWOW64\vgstobfjhlujqum.exe 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe File created C:\Windows\SysWOW64\pyogxjrx.exe 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe File opened for modification C:\Windows\SysWOW64\pyogxjrx.exe 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe File created C:\Windows\SysWOW64\vgstobfjhlujqum.exe 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe -
Drops file in Program Files directory 14 IoCs
Processes:
pyogxjrx.exepyogxjrx.exedescription ioc process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pyogxjrx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pyogxjrx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pyogxjrx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pyogxjrx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pyogxjrx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal pyogxjrx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pyogxjrx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal pyogxjrx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pyogxjrx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe pyogxjrx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pyogxjrx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe pyogxjrx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal pyogxjrx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal pyogxjrx.exe -
Drops file in Windows directory 3 IoCs
Processes:
WINWORD.EXE7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exedescription ioc process File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
tgqlplvvjw.exe7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc tgqlplvvjw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs tgqlplvvjw.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2ECBB05847E1399E52BDBAA733E8D4CE" 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf tgqlplvvjw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg tgqlplvvjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" tgqlplvvjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472C7F9D5783536D4576DC77202DD87D8465DE" 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8BFF82482985139134D65C7E95BC95E144583767316237D79A" 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat tgqlplvvjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" tgqlplvvjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" tgqlplvvjw.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BB3FE6B21DCD27AD1A68B7D9011" 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193AC6781594DABFB8C07CE8EDE237CB" 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh tgqlplvvjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" tgqlplvvjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" tgqlplvvjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" tgqlplvvjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCAFACAFE11F2E2837F3B43869D39E2B0FE02F842140333E2CF459E08A7" 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1540 WINWORD.EXE 1540 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exetgqlplvvjw.exevgstobfjhlujqum.exepyogxjrx.execeiblppwmyoyn.exepyogxjrx.exepid process 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1604 tgqlplvvjw.exe 1604 tgqlplvvjw.exe 1604 tgqlplvvjw.exe 4252 vgstobfjhlujqum.exe 1604 tgqlplvvjw.exe 4252 vgstobfjhlujqum.exe 1604 tgqlplvvjw.exe 1604 tgqlplvvjw.exe 4252 vgstobfjhlujqum.exe 4252 vgstobfjhlujqum.exe 1604 tgqlplvvjw.exe 1604 tgqlplvvjw.exe 4252 vgstobfjhlujqum.exe 4252 vgstobfjhlujqum.exe 1604 tgqlplvvjw.exe 1604 tgqlplvvjw.exe 4252 vgstobfjhlujqum.exe 4252 vgstobfjhlujqum.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 4252 vgstobfjhlujqum.exe 4252 vgstobfjhlujqum.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 4252 vgstobfjhlujqum.exe 4252 vgstobfjhlujqum.exe 3668 pyogxjrx.exe 3668 pyogxjrx.exe 3668 pyogxjrx.exe 3668 pyogxjrx.exe 3668 pyogxjrx.exe 3668 pyogxjrx.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exetgqlplvvjw.exevgstobfjhlujqum.exepyogxjrx.execeiblppwmyoyn.exepyogxjrx.exepid process 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1604 tgqlplvvjw.exe 1604 tgqlplvvjw.exe 1604 tgqlplvvjw.exe 4252 vgstobfjhlujqum.exe 4252 vgstobfjhlujqum.exe 4252 vgstobfjhlujqum.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 3668 pyogxjrx.exe 3668 pyogxjrx.exe 3668 pyogxjrx.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exetgqlplvvjw.exevgstobfjhlujqum.exepyogxjrx.execeiblppwmyoyn.exepyogxjrx.exepid process 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe 1604 tgqlplvvjw.exe 1604 tgqlplvvjw.exe 1604 tgqlplvvjw.exe 4252 vgstobfjhlujqum.exe 4252 vgstobfjhlujqum.exe 4252 vgstobfjhlujqum.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 748 pyogxjrx.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 2676 ceiblppwmyoyn.exe 3668 pyogxjrx.exe 3668 pyogxjrx.exe 3668 pyogxjrx.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 1540 WINWORD.EXE 1540 WINWORD.EXE 1540 WINWORD.EXE 1540 WINWORD.EXE 1540 WINWORD.EXE 1540 WINWORD.EXE 1540 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exetgqlplvvjw.exedescription pid process target process PID 1624 wrote to memory of 1604 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe tgqlplvvjw.exe PID 1624 wrote to memory of 1604 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe tgqlplvvjw.exe PID 1624 wrote to memory of 1604 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe tgqlplvvjw.exe PID 1624 wrote to memory of 4252 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe vgstobfjhlujqum.exe PID 1624 wrote to memory of 4252 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe vgstobfjhlujqum.exe PID 1624 wrote to memory of 4252 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe vgstobfjhlujqum.exe PID 1624 wrote to memory of 748 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe pyogxjrx.exe PID 1624 wrote to memory of 748 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe pyogxjrx.exe PID 1624 wrote to memory of 748 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe pyogxjrx.exe PID 1624 wrote to memory of 2676 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe ceiblppwmyoyn.exe PID 1624 wrote to memory of 2676 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe ceiblppwmyoyn.exe PID 1624 wrote to memory of 2676 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe ceiblppwmyoyn.exe PID 1624 wrote to memory of 1540 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe WINWORD.EXE PID 1624 wrote to memory of 1540 1624 7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe WINWORD.EXE PID 1604 wrote to memory of 3668 1604 tgqlplvvjw.exe pyogxjrx.exe PID 1604 wrote to memory of 3668 1604 tgqlplvvjw.exe pyogxjrx.exe PID 1604 wrote to memory of 3668 1604 tgqlplvvjw.exe pyogxjrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe"C:\Users\Admin\AppData\Local\Temp\7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tgqlplvvjw.exetgqlplvvjw.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\pyogxjrx.exeC:\Windows\system32\pyogxjrx.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\vgstobfjhlujqum.exevgstobfjhlujqum.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\pyogxjrx.exepyogxjrx.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ceiblppwmyoyn.execeiblppwmyoyn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
6Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD5be0d60dffece9967de1fba3d414b2033
SHA10d075d108b9ad915d43662c27be6e2076a4bd912
SHA25670fa5e72a987f282ff73cd9683684881a6bf39f5f2c17b1b206db8f479e804cf
SHA512307effa47d05bff340c25ee42ce3028a2386befa0b189ef826d75f1d69f7932dc3d38195b57732c877ea24e2990ec0fd3c8ed2ec9f7e2f6e6e71b4b99e08d63a
-
C:\Windows\SysWOW64\ceiblppwmyoyn.exeFilesize
255KB
MD58e9288e4f93172fe0d7a9f56f5ef58a7
SHA11aab25fc58864f64066f9ad5cbe6858284dc2d40
SHA25659e9958fc67dc33ef8bfa91f2a2848a3c4d333cdafb63b03298f31eb90a7f795
SHA5122238f9dc0b1c86426e2c8b76d49deec434caafd7a733798a9c017fbc486aeeb614d43c93b9278a4aaced4978b277cdafda9c61edf0c7362f43f482f96b44ed0b
-
C:\Windows\SysWOW64\ceiblppwmyoyn.exeFilesize
255KB
MD58e9288e4f93172fe0d7a9f56f5ef58a7
SHA11aab25fc58864f64066f9ad5cbe6858284dc2d40
SHA25659e9958fc67dc33ef8bfa91f2a2848a3c4d333cdafb63b03298f31eb90a7f795
SHA5122238f9dc0b1c86426e2c8b76d49deec434caafd7a733798a9c017fbc486aeeb614d43c93b9278a4aaced4978b277cdafda9c61edf0c7362f43f482f96b44ed0b
-
C:\Windows\SysWOW64\pyogxjrx.exeFilesize
255KB
MD50fc9df71a966d37792d979031dae4200
SHA1b5ac89df88a6fa97bfd5e2ac5a5de4dc7003f687
SHA256146282fad21f853e9d14e0a7373be6f0405ec21d7c4bbe20ef321ed5a71b6591
SHA512b6493c239fcc77cd634e45d32346bb1e7f3826577b4de8d5b89d2c4af070a1249f982d1fd6cd14c1eb58278f908eebe3844edc299f32c488b2ac708ccddb0601
-
C:\Windows\SysWOW64\pyogxjrx.exeFilesize
255KB
MD50fc9df71a966d37792d979031dae4200
SHA1b5ac89df88a6fa97bfd5e2ac5a5de4dc7003f687
SHA256146282fad21f853e9d14e0a7373be6f0405ec21d7c4bbe20ef321ed5a71b6591
SHA512b6493c239fcc77cd634e45d32346bb1e7f3826577b4de8d5b89d2c4af070a1249f982d1fd6cd14c1eb58278f908eebe3844edc299f32c488b2ac708ccddb0601
-
C:\Windows\SysWOW64\pyogxjrx.exeFilesize
255KB
MD50fc9df71a966d37792d979031dae4200
SHA1b5ac89df88a6fa97bfd5e2ac5a5de4dc7003f687
SHA256146282fad21f853e9d14e0a7373be6f0405ec21d7c4bbe20ef321ed5a71b6591
SHA512b6493c239fcc77cd634e45d32346bb1e7f3826577b4de8d5b89d2c4af070a1249f982d1fd6cd14c1eb58278f908eebe3844edc299f32c488b2ac708ccddb0601
-
C:\Windows\SysWOW64\tgqlplvvjw.exeFilesize
255KB
MD5efbb0b1180d743fc6f09d98eed2f1b75
SHA1ec8bd6a4e7945eefcd630b123111e6748a3f77f7
SHA256e98667ce28724afad87c9e1821c361d6a0261c324962ba8719fc9745f2c3ae34
SHA5123cab0c6f6bb06045e77f2b3f58eb0656c67b525bdae0495029ed4ffd8bc3e7c2fc8f25d2559dfee10e990d92656d0e16842d86a733f7a9190724d0316b1f7546
-
C:\Windows\SysWOW64\tgqlplvvjw.exeFilesize
255KB
MD5efbb0b1180d743fc6f09d98eed2f1b75
SHA1ec8bd6a4e7945eefcd630b123111e6748a3f77f7
SHA256e98667ce28724afad87c9e1821c361d6a0261c324962ba8719fc9745f2c3ae34
SHA5123cab0c6f6bb06045e77f2b3f58eb0656c67b525bdae0495029ed4ffd8bc3e7c2fc8f25d2559dfee10e990d92656d0e16842d86a733f7a9190724d0316b1f7546
-
C:\Windows\SysWOW64\vgstobfjhlujqum.exeFilesize
255KB
MD50f27ecc896d6720c34011f493f9bbc2d
SHA1415fe15b27751ff44f0ff05936865020dd918afd
SHA256f4ea7661d198aeee0eedf519988b55ff41dd45f898d2039d2e43187ca0f16b7e
SHA512da9331a183c62b487425a02ed114c6609b8ad0714ebaec47b62bb0e21ad848a723903b2023b962430bea7895eac6c4be0b58236f40ceb67df83014709c15cc7e
-
C:\Windows\SysWOW64\vgstobfjhlujqum.exeFilesize
255KB
MD50f27ecc896d6720c34011f493f9bbc2d
SHA1415fe15b27751ff44f0ff05936865020dd918afd
SHA256f4ea7661d198aeee0eedf519988b55ff41dd45f898d2039d2e43187ca0f16b7e
SHA512da9331a183c62b487425a02ed114c6609b8ad0714ebaec47b62bb0e21ad848a723903b2023b962430bea7895eac6c4be0b58236f40ceb67df83014709c15cc7e
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
memory/748-139-0x0000000000000000-mapping.dmp
-
memory/748-147-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/748-164-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1540-159-0x00007FF9A32E0000-0x00007FF9A32F0000-memory.dmpFilesize
64KB
-
memory/1540-154-0x00007FF9A5870000-0x00007FF9A5880000-memory.dmpFilesize
64KB
-
memory/1540-160-0x00007FF9A32E0000-0x00007FF9A32F0000-memory.dmpFilesize
64KB
-
memory/1540-149-0x0000000000000000-mapping.dmp
-
memory/1540-158-0x00007FF9A5870000-0x00007FF9A5880000-memory.dmpFilesize
64KB
-
memory/1540-157-0x00007FF9A5870000-0x00007FF9A5880000-memory.dmpFilesize
64KB
-
memory/1540-156-0x00007FF9A5870000-0x00007FF9A5880000-memory.dmpFilesize
64KB
-
memory/1540-155-0x00007FF9A5870000-0x00007FF9A5880000-memory.dmpFilesize
64KB
-
memory/1604-145-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1604-133-0x0000000000000000-mapping.dmp
-
memory/1604-162-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1624-132-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1624-150-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2676-142-0x0000000000000000-mapping.dmp
-
memory/2676-148-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2676-165-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3668-153-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3668-151-0x0000000000000000-mapping.dmp
-
memory/3668-166-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4252-163-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4252-136-0x0000000000000000-mapping.dmp
-
memory/4252-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB