Analysis
-
max time kernel
172s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:03
Behavioral task
behavioral1
Sample
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe
Resource
win10v2004-20221111-en
General
-
Target
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe
-
Size
255KB
-
MD5
17ea322d7e0e57a049fcd9058b86a036
-
SHA1
150f8835827500799a2b392dca09a9dad6bfbb65
-
SHA256
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2
-
SHA512
177df88560abc3c74fa4c49d9172e4ee3236512d2cb33b78d68b8eccdb5625b88f4bb7a76d600209f93bb85de348f7d12a1fec487528e7ba1f3ec4c9b794f38b
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJj:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
kifqxfnkwr.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" kifqxfnkwr.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
kifqxfnkwr.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kifqxfnkwr.exe -
Processes:
kifqxfnkwr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kifqxfnkwr.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
kifqxfnkwr.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kifqxfnkwr.exe -
Executes dropped EXE 5 IoCs
Processes:
kifqxfnkwr.exesxipbpnedmjbnhh.exevhkrytby.exezdeazndvfbfbh.exevhkrytby.exepid process 4032 kifqxfnkwr.exe 1164 sxipbpnedmjbnhh.exe 1848 vhkrytby.exe 3896 zdeazndvfbfbh.exe 4704 vhkrytby.exe -
Processes:
resource yara_rule behavioral2/memory/624-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\kifqxfnkwr.exe upx C:\Windows\SysWOW64\kifqxfnkwr.exe upx C:\Windows\SysWOW64\sxipbpnedmjbnhh.exe upx C:\Windows\SysWOW64\sxipbpnedmjbnhh.exe upx C:\Windows\SysWOW64\vhkrytby.exe upx C:\Windows\SysWOW64\vhkrytby.exe upx C:\Windows\SysWOW64\zdeazndvfbfbh.exe upx C:\Windows\SysWOW64\zdeazndvfbfbh.exe upx behavioral2/memory/4032-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1164-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1848-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\vhkrytby.exe upx behavioral2/memory/624-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4704-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx behavioral2/memory/4032-163-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1164-164-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1848-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3896-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4704-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe -
Processes:
kifqxfnkwr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kifqxfnkwr.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
sxipbpnedmjbnhh.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run sxipbpnedmjbnhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gbvbcvwq = "kifqxfnkwr.exe" sxipbpnedmjbnhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nuburwwa = "sxipbpnedmjbnhh.exe" sxipbpnedmjbnhh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "zdeazndvfbfbh.exe" sxipbpnedmjbnhh.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vhkrytby.exevhkrytby.exekifqxfnkwr.exedescription ioc process File opened (read-only) \??\u: vhkrytby.exe File opened (read-only) \??\w: vhkrytby.exe File opened (read-only) \??\e: vhkrytby.exe File opened (read-only) \??\n: vhkrytby.exe File opened (read-only) \??\k: vhkrytby.exe File opened (read-only) \??\m: vhkrytby.exe File opened (read-only) \??\n: vhkrytby.exe File opened (read-only) \??\j: kifqxfnkwr.exe File opened (read-only) \??\f: vhkrytby.exe File opened (read-only) \??\b: kifqxfnkwr.exe File opened (read-only) \??\h: kifqxfnkwr.exe File opened (read-only) \??\r: kifqxfnkwr.exe File opened (read-only) \??\z: vhkrytby.exe File opened (read-only) \??\a: vhkrytby.exe File opened (read-only) \??\b: vhkrytby.exe File opened (read-only) \??\q: vhkrytby.exe File opened (read-only) \??\p: vhkrytby.exe File opened (read-only) \??\z: kifqxfnkwr.exe File opened (read-only) \??\u: kifqxfnkwr.exe File opened (read-only) \??\j: vhkrytby.exe File opened (read-only) \??\o: vhkrytby.exe File opened (read-only) \??\p: vhkrytby.exe File opened (read-only) \??\w: vhkrytby.exe File opened (read-only) \??\g: vhkrytby.exe File opened (read-only) \??\a: kifqxfnkwr.exe File opened (read-only) \??\i: kifqxfnkwr.exe File opened (read-only) \??\s: kifqxfnkwr.exe File opened (read-only) \??\g: vhkrytby.exe File opened (read-only) \??\u: vhkrytby.exe File opened (read-only) \??\x: vhkrytby.exe File opened (read-only) \??\o: vhkrytby.exe File opened (read-only) \??\o: kifqxfnkwr.exe File opened (read-only) \??\p: kifqxfnkwr.exe File opened (read-only) \??\r: vhkrytby.exe File opened (read-only) \??\s: vhkrytby.exe File opened (read-only) \??\v: vhkrytby.exe File opened (read-only) \??\k: kifqxfnkwr.exe File opened (read-only) \??\v: kifqxfnkwr.exe File opened (read-only) \??\h: vhkrytby.exe File opened (read-only) \??\i: vhkrytby.exe File opened (read-only) \??\l: vhkrytby.exe File opened (read-only) \??\y: vhkrytby.exe File opened (read-only) \??\k: vhkrytby.exe File opened (read-only) \??\l: vhkrytby.exe File opened (read-only) \??\z: vhkrytby.exe File opened (read-only) \??\g: kifqxfnkwr.exe File opened (read-only) \??\m: kifqxfnkwr.exe File opened (read-only) \??\h: vhkrytby.exe File opened (read-only) \??\s: vhkrytby.exe File opened (read-only) \??\t: vhkrytby.exe File opened (read-only) \??\a: vhkrytby.exe File opened (read-only) \??\f: vhkrytby.exe File opened (read-only) \??\q: vhkrytby.exe File opened (read-only) \??\t: vhkrytby.exe File opened (read-only) \??\e: kifqxfnkwr.exe File opened (read-only) \??\f: kifqxfnkwr.exe File opened (read-only) \??\b: vhkrytby.exe File opened (read-only) \??\t: kifqxfnkwr.exe File opened (read-only) \??\x: kifqxfnkwr.exe File opened (read-only) \??\y: vhkrytby.exe File opened (read-only) \??\m: vhkrytby.exe File opened (read-only) \??\v: vhkrytby.exe File opened (read-only) \??\e: vhkrytby.exe File opened (read-only) \??\j: vhkrytby.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
kifqxfnkwr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" kifqxfnkwr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" kifqxfnkwr.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/624-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4032-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1164-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1848-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/624-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4704-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4032-163-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1164-164-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1848-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3896-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4704-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exekifqxfnkwr.exedescription ioc process File created C:\Windows\SysWOW64\sxipbpnedmjbnhh.exe 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe File opened for modification C:\Windows\SysWOW64\sxipbpnedmjbnhh.exe 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe File created C:\Windows\SysWOW64\vhkrytby.exe 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe File opened for modification C:\Windows\SysWOW64\vhkrytby.exe 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe File created C:\Windows\SysWOW64\zdeazndvfbfbh.exe 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll kifqxfnkwr.exe File created C:\Windows\SysWOW64\kifqxfnkwr.exe 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe File opened for modification C:\Windows\SysWOW64\kifqxfnkwr.exe 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe File opened for modification C:\Windows\SysWOW64\zdeazndvfbfbh.exe 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe -
Drops file in Program Files directory 14 IoCs
Processes:
vhkrytby.exevhkrytby.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vhkrytby.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal vhkrytby.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vhkrytby.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vhkrytby.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vhkrytby.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vhkrytby.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vhkrytby.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vhkrytby.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal vhkrytby.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vhkrytby.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vhkrytby.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal vhkrytby.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vhkrytby.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal vhkrytby.exe -
Drops file in Windows directory 3 IoCs
Processes:
WINWORD.EXE7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exedescription ioc process File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exekifqxfnkwr.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332C089C5682276D3476D670512CAE7CF265DB" 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCDF9BCF964F299830B3A4186EE3994B08B02F94362033BE1BF42E808A2" 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat kifqxfnkwr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs kifqxfnkwr.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B15B47E5389952BEB9D632E8D4CF" 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F66BB7FF1D21DAD273D1A88B7E906B" 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184EC77415E0DBBEB9BD7FE3ECE034C8" 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kifqxfnkwr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc kifqxfnkwr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" kifqxfnkwr.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FFBFF83485C85699032D7297D91BC92E134594567416345D79C" 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" kifqxfnkwr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf kifqxfnkwr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kifqxfnkwr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh kifqxfnkwr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" kifqxfnkwr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg kifqxfnkwr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kifqxfnkwr.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3632 WINWORD.EXE 3632 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exekifqxfnkwr.exesxipbpnedmjbnhh.exevhkrytby.exezdeazndvfbfbh.exevhkrytby.exepid process 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 4704 vhkrytby.exe 4704 vhkrytby.exe 4704 vhkrytby.exe 4704 vhkrytby.exe 4704 vhkrytby.exe 4704 vhkrytby.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exekifqxfnkwr.exesxipbpnedmjbnhh.exevhkrytby.exezdeazndvfbfbh.exevhkrytby.exepid process 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 4704 vhkrytby.exe 4704 vhkrytby.exe 4704 vhkrytby.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exekifqxfnkwr.exesxipbpnedmjbnhh.exevhkrytby.exezdeazndvfbfbh.exevhkrytby.exepid process 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 4032 kifqxfnkwr.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1164 sxipbpnedmjbnhh.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 1848 vhkrytby.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 3896 zdeazndvfbfbh.exe 4704 vhkrytby.exe 4704 vhkrytby.exe 4704 vhkrytby.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 3632 WINWORD.EXE 3632 WINWORD.EXE 3632 WINWORD.EXE 3632 WINWORD.EXE 3632 WINWORD.EXE 3632 WINWORD.EXE 3632 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exekifqxfnkwr.exedescription pid process target process PID 624 wrote to memory of 4032 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe kifqxfnkwr.exe PID 624 wrote to memory of 4032 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe kifqxfnkwr.exe PID 624 wrote to memory of 4032 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe kifqxfnkwr.exe PID 624 wrote to memory of 1164 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe sxipbpnedmjbnhh.exe PID 624 wrote to memory of 1164 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe sxipbpnedmjbnhh.exe PID 624 wrote to memory of 1164 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe sxipbpnedmjbnhh.exe PID 624 wrote to memory of 1848 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe vhkrytby.exe PID 624 wrote to memory of 1848 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe vhkrytby.exe PID 624 wrote to memory of 1848 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe vhkrytby.exe PID 624 wrote to memory of 3896 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe zdeazndvfbfbh.exe PID 624 wrote to memory of 3896 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe zdeazndvfbfbh.exe PID 624 wrote to memory of 3896 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe zdeazndvfbfbh.exe PID 624 wrote to memory of 3632 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe WINWORD.EXE PID 624 wrote to memory of 3632 624 7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe WINWORD.EXE PID 4032 wrote to memory of 4704 4032 kifqxfnkwr.exe vhkrytby.exe PID 4032 wrote to memory of 4704 4032 kifqxfnkwr.exe vhkrytby.exe PID 4032 wrote to memory of 4704 4032 kifqxfnkwr.exe vhkrytby.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe"C:\Users\Admin\AppData\Local\Temp\7624a980418d2cfa7f02003d90b5abcdab8252a15e33376e713ed95d3e7f6fc2.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\kifqxfnkwr.exekifqxfnkwr.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vhkrytby.exeC:\Windows\system32\vhkrytby.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\sxipbpnedmjbnhh.exesxipbpnedmjbnhh.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\vhkrytby.exevhkrytby.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\zdeazndvfbfbh.exezdeazndvfbfbh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
6Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD545e6d0b4ce9182698f5d7df30454b43c
SHA1877cdfc870da983068aadd723f2fab0006d6785c
SHA256e172837ead340baa6f23eb5b586ba61568486cce79a8ece48b4b47a3d78d15ec
SHA5123074664dc2435c894c3cf9ab4a06c6d26d1e3b520c048e8304bc0d1912facfaf2865a977ed53ad2300d13a020b4b785fab4940039fbe550cc76aef86255772bf
-
C:\Windows\SysWOW64\kifqxfnkwr.exeFilesize
255KB
MD5cfdf69782679c3e78c06e0258800c375
SHA17213d090f6e6190a595f4f5a2a89be7a509437d4
SHA256cfffb3c489fecfee19270b586ca7c70911aeaec864d7495401a91a4985eb2972
SHA512d32b7bfb8979d0d58f27433155eaa463b74a27ef4cc3089f7d1eea31bf7364f5703988d684f6de003665c7f261a85dbbbe673e752cbcfa919798c241be356692
-
C:\Windows\SysWOW64\kifqxfnkwr.exeFilesize
255KB
MD5cfdf69782679c3e78c06e0258800c375
SHA17213d090f6e6190a595f4f5a2a89be7a509437d4
SHA256cfffb3c489fecfee19270b586ca7c70911aeaec864d7495401a91a4985eb2972
SHA512d32b7bfb8979d0d58f27433155eaa463b74a27ef4cc3089f7d1eea31bf7364f5703988d684f6de003665c7f261a85dbbbe673e752cbcfa919798c241be356692
-
C:\Windows\SysWOW64\sxipbpnedmjbnhh.exeFilesize
255KB
MD58c71c6d0db1dd72ec2b692a8c10bca3f
SHA1902458744773678de7e596c7320559a6ecd0aa64
SHA256d68004b9ed6e9585f14227dffeb2f578855e58d3445a68b239ce6ec06043e768
SHA512626e01e3717bc97678bff5c7f81db3437b6c2c9533f857bc0c2d363a8be7d1eb58cfe351714a95c2b0cfb4dec8247e066bb5b04a0612a379060571bc5fa18520
-
C:\Windows\SysWOW64\sxipbpnedmjbnhh.exeFilesize
255KB
MD58c71c6d0db1dd72ec2b692a8c10bca3f
SHA1902458744773678de7e596c7320559a6ecd0aa64
SHA256d68004b9ed6e9585f14227dffeb2f578855e58d3445a68b239ce6ec06043e768
SHA512626e01e3717bc97678bff5c7f81db3437b6c2c9533f857bc0c2d363a8be7d1eb58cfe351714a95c2b0cfb4dec8247e066bb5b04a0612a379060571bc5fa18520
-
C:\Windows\SysWOW64\vhkrytby.exeFilesize
255KB
MD58c0a76dd91d6a33ad42e17828d6b1862
SHA1a1336d5fc60979c2d662b47169fc3914d23b01fd
SHA25624698c9635b9b0222f0208df8ca7a8092646fa68cf952ffe129f4c1a6dcf36f8
SHA512617a7183fd3842183237bfdc308e1f2f56316a2f756eb6dff8467647522c73d7cf9d93e2f6ab98c479bc7a570e3fdd186bf09537319d661c601eb104814936aa
-
C:\Windows\SysWOW64\vhkrytby.exeFilesize
255KB
MD58c0a76dd91d6a33ad42e17828d6b1862
SHA1a1336d5fc60979c2d662b47169fc3914d23b01fd
SHA25624698c9635b9b0222f0208df8ca7a8092646fa68cf952ffe129f4c1a6dcf36f8
SHA512617a7183fd3842183237bfdc308e1f2f56316a2f756eb6dff8467647522c73d7cf9d93e2f6ab98c479bc7a570e3fdd186bf09537319d661c601eb104814936aa
-
C:\Windows\SysWOW64\vhkrytby.exeFilesize
255KB
MD58c0a76dd91d6a33ad42e17828d6b1862
SHA1a1336d5fc60979c2d662b47169fc3914d23b01fd
SHA25624698c9635b9b0222f0208df8ca7a8092646fa68cf952ffe129f4c1a6dcf36f8
SHA512617a7183fd3842183237bfdc308e1f2f56316a2f756eb6dff8467647522c73d7cf9d93e2f6ab98c479bc7a570e3fdd186bf09537319d661c601eb104814936aa
-
C:\Windows\SysWOW64\zdeazndvfbfbh.exeFilesize
255KB
MD5aed4f9508836051c1c724673ba3044b6
SHA1f5327cd1a1b20e1de7cbbc129dbdb3c6dbe07007
SHA2565806e845af7da7421f5093132f41deb864a483544c6e6b13f06a400eec0847fc
SHA512148688f607be03727cc094f5de88605a5368c772c8a65a2394027abb80f2f8cdfa9ba975005d77832f91ae9fa3e18d71fb04fb3319b0ff86d829d8ab13f8b214
-
C:\Windows\SysWOW64\zdeazndvfbfbh.exeFilesize
255KB
MD5aed4f9508836051c1c724673ba3044b6
SHA1f5327cd1a1b20e1de7cbbc129dbdb3c6dbe07007
SHA2565806e845af7da7421f5093132f41deb864a483544c6e6b13f06a400eec0847fc
SHA512148688f607be03727cc094f5de88605a5368c772c8a65a2394027abb80f2f8cdfa9ba975005d77832f91ae9fa3e18d71fb04fb3319b0ff86d829d8ab13f8b214
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
memory/624-152-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/624-132-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1164-136-0x0000000000000000-mapping.dmp
-
memory/1164-164-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1164-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1848-165-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1848-147-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1848-139-0x0000000000000000-mapping.dmp
-
memory/3632-160-0x00007FF82F050000-0x00007FF82F060000-memory.dmpFilesize
64KB
-
memory/3632-154-0x00007FF8314D0000-0x00007FF8314E0000-memory.dmpFilesize
64KB
-
memory/3632-155-0x00007FF8314D0000-0x00007FF8314E0000-memory.dmpFilesize
64KB
-
memory/3632-156-0x00007FF8314D0000-0x00007FF8314E0000-memory.dmpFilesize
64KB
-
memory/3632-157-0x00007FF8314D0000-0x00007FF8314E0000-memory.dmpFilesize
64KB
-
memory/3632-158-0x00007FF8314D0000-0x00007FF8314E0000-memory.dmpFilesize
64KB
-
memory/3632-151-0x0000000000000000-mapping.dmp
-
memory/3632-161-0x00007FF82F050000-0x00007FF82F060000-memory.dmpFilesize
64KB
-
memory/3896-148-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3896-166-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3896-142-0x0000000000000000-mapping.dmp
-
memory/4032-145-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4032-163-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4032-133-0x0000000000000000-mapping.dmp
-
memory/4704-149-0x0000000000000000-mapping.dmp
-
memory/4704-153-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4704-167-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB