Analysis
-
max time kernel
159s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:04
Behavioral task
behavioral1
Sample
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe
Resource
win7-20221111-en
General
-
Target
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe
-
Size
255KB
-
MD5
1fa7e55e39dd7012d1666556f8012011
-
SHA1
2d9b7187430db4f4651b28d5ece54079a28beef9
-
SHA256
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427
-
SHA512
1251ffbdd6d519fbd9fbd34affecb86f641758365c308a0910fc2e9dbe5241b6bba78c08b8addcfa2843aaf583cb6722cc5bbf1162d457a2c1023474cc061f53
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJk:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
aysdpzhcqi.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" aysdpzhcqi.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
aysdpzhcqi.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" aysdpzhcqi.exe -
Processes:
aysdpzhcqi.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aysdpzhcqi.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
aysdpzhcqi.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" aysdpzhcqi.exe -
Executes dropped EXE 5 IoCs
Processes:
aysdpzhcqi.exezdgexajzlbvwqfg.exevznmmmdj.execciavxhajwbdw.exevznmmmdj.exepid process 4292 aysdpzhcqi.exe 4168 zdgexajzlbvwqfg.exe 4200 vznmmmdj.exe 3372 cciavxhajwbdw.exe 1844 vznmmmdj.exe -
Processes:
resource yara_rule behavioral2/memory/4416-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4416-133-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\aysdpzhcqi.exe upx C:\Windows\SysWOW64\aysdpzhcqi.exe upx C:\Windows\SysWOW64\zdgexajzlbvwqfg.exe upx C:\Windows\SysWOW64\zdgexajzlbvwqfg.exe upx C:\Windows\SysWOW64\vznmmmdj.exe upx C:\Windows\SysWOW64\vznmmmdj.exe upx C:\Windows\SysWOW64\cciavxhajwbdw.exe upx C:\Windows\SysWOW64\cciavxhajwbdw.exe upx behavioral2/memory/4200-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3372-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4168-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4292-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\vznmmmdj.exe upx behavioral2/memory/1844-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4416-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4292-155-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4168-156-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4200-157-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3372-158-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1844-159-0x0000000000400000-0x00000000004A0000-memory.dmp upx \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
aysdpzhcqi.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" aysdpzhcqi.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zdgexajzlbvwqfg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run zdgexajzlbvwqfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pyszbqtn = "aysdpzhcqi.exe" zdgexajzlbvwqfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ieyvcjeb = "zdgexajzlbvwqfg.exe" zdgexajzlbvwqfg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "cciavxhajwbdw.exe" zdgexajzlbvwqfg.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
vznmmmdj.exeaysdpzhcqi.exevznmmmdj.exedescription ioc process File opened (read-only) \??\m: vznmmmdj.exe File opened (read-only) \??\o: vznmmmdj.exe File opened (read-only) \??\q: vznmmmdj.exe File opened (read-only) \??\w: vznmmmdj.exe File opened (read-only) \??\z: vznmmmdj.exe File opened (read-only) \??\k: aysdpzhcqi.exe File opened (read-only) \??\v: aysdpzhcqi.exe File opened (read-only) \??\j: aysdpzhcqi.exe File opened (read-only) \??\w: aysdpzhcqi.exe File opened (read-only) \??\e: vznmmmdj.exe File opened (read-only) \??\g: vznmmmdj.exe File opened (read-only) \??\s: vznmmmdj.exe File opened (read-only) \??\t: vznmmmdj.exe File opened (read-only) \??\k: vznmmmdj.exe File opened (read-only) \??\n: vznmmmdj.exe File opened (read-only) \??\u: vznmmmdj.exe File opened (read-only) \??\q: vznmmmdj.exe File opened (read-only) \??\q: aysdpzhcqi.exe File opened (read-only) \??\z: aysdpzhcqi.exe File opened (read-only) \??\l: vznmmmdj.exe File opened (read-only) \??\l: vznmmmdj.exe File opened (read-only) \??\p: vznmmmdj.exe File opened (read-only) \??\m: aysdpzhcqi.exe File opened (read-only) \??\r: aysdpzhcqi.exe File opened (read-only) \??\b: vznmmmdj.exe File opened (read-only) \??\j: vznmmmdj.exe File opened (read-only) \??\w: vznmmmdj.exe File opened (read-only) \??\j: vznmmmdj.exe File opened (read-only) \??\t: aysdpzhcqi.exe File opened (read-only) \??\y: aysdpzhcqi.exe File opened (read-only) \??\e: aysdpzhcqi.exe File opened (read-only) \??\g: vznmmmdj.exe File opened (read-only) \??\r: vznmmmdj.exe File opened (read-only) \??\h: vznmmmdj.exe File opened (read-only) \??\i: vznmmmdj.exe File opened (read-only) \??\x: vznmmmdj.exe File opened (read-only) \??\m: vznmmmdj.exe File opened (read-only) \??\u: vznmmmdj.exe File opened (read-only) \??\i: vznmmmdj.exe File opened (read-only) \??\y: vznmmmdj.exe File opened (read-only) \??\u: aysdpzhcqi.exe File opened (read-only) \??\s: vznmmmdj.exe File opened (read-only) \??\x: vznmmmdj.exe File opened (read-only) \??\f: aysdpzhcqi.exe File opened (read-only) \??\n: aysdpzhcqi.exe File opened (read-only) \??\o: aysdpzhcqi.exe File opened (read-only) \??\a: vznmmmdj.exe File opened (read-only) \??\a: aysdpzhcqi.exe File opened (read-only) \??\k: vznmmmdj.exe File opened (read-only) \??\n: vznmmmdj.exe File opened (read-only) \??\v: vznmmmdj.exe File opened (read-only) \??\e: vznmmmdj.exe File opened (read-only) \??\h: vznmmmdj.exe File opened (read-only) \??\z: vznmmmdj.exe File opened (read-only) \??\l: aysdpzhcqi.exe File opened (read-only) \??\b: aysdpzhcqi.exe File opened (read-only) \??\g: aysdpzhcqi.exe File opened (read-only) \??\h: aysdpzhcqi.exe File opened (read-only) \??\s: aysdpzhcqi.exe File opened (read-only) \??\y: vznmmmdj.exe File opened (read-only) \??\f: vznmmmdj.exe File opened (read-only) \??\v: vznmmmdj.exe File opened (read-only) \??\x: aysdpzhcqi.exe File opened (read-only) \??\p: vznmmmdj.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
aysdpzhcqi.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" aysdpzhcqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" aysdpzhcqi.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4200-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3372-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4168-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4292-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1844-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4416-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4292-155-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4168-156-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4200-157-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3372-158-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1844-159-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exeaysdpzhcqi.exedescription ioc process File created C:\Windows\SysWOW64\aysdpzhcqi.exe 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe File created C:\Windows\SysWOW64\vznmmmdj.exe 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe File created C:\Windows\SysWOW64\cciavxhajwbdw.exe 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe File opened for modification C:\Windows\SysWOW64\cciavxhajwbdw.exe 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll aysdpzhcqi.exe File opened for modification C:\Windows\SysWOW64\aysdpzhcqi.exe 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe File created C:\Windows\SysWOW64\zdgexajzlbvwqfg.exe 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe File opened for modification C:\Windows\SysWOW64\zdgexajzlbvwqfg.exe 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe File opened for modification C:\Windows\SysWOW64\vznmmmdj.exe 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe -
Drops file in Program Files directory 19 IoCs
Processes:
vznmmmdj.exevznmmmdj.exedescription ioc process File opened for modification \??\c:\Program Files\GroupClear.doc.exe vznmmmdj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vznmmmdj.exe File created \??\c:\Program Files\GroupClear.doc.exe vznmmmdj.exe File opened for modification C:\Program Files\GroupClear.doc.exe vznmmmdj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vznmmmdj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vznmmmdj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vznmmmdj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vznmmmdj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal vznmmmdj.exe File opened for modification C:\Program Files\GroupClear.nal vznmmmdj.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vznmmmdj.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vznmmmdj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal vznmmmdj.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vznmmmdj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vznmmmdj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vznmmmdj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal vznmmmdj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal vznmmmdj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vznmmmdj.exe -
Drops file in Windows directory 3 IoCs
Processes:
WINWORD.EXE66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exedescription ioc process File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exeaysdpzhcqi.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33422D089D5183206D4577A1702E2CDD7C8F64AB" 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B02047E039EF53BABAA632EAD7CC" 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1849C6741490DBC4B8BE7C97EDE234CB" 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" aysdpzhcqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf aysdpzhcqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" aysdpzhcqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs aysdpzhcqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFFAB0F96AF1E584783B4086EA3EE2B0FA028F4215023EE2CF42E608D4" 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F168C3FF6722A9D272D1D68B7D9164" 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat aysdpzhcqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" aysdpzhcqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc aysdpzhcqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8BFFFF482985699045D62F7D9DBD97E141584067456343D6EA" 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" aysdpzhcqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh aysdpzhcqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" aysdpzhcqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg aysdpzhcqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" aysdpzhcqi.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3112 WINWORD.EXE 3112 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exeaysdpzhcqi.exezdgexajzlbvwqfg.exevznmmmdj.execciavxhajwbdw.exepid process 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exeaysdpzhcqi.exezdgexajzlbvwqfg.exevznmmmdj.execciavxhajwbdw.exevznmmmdj.exepid process 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 1844 vznmmmdj.exe 1844 vznmmmdj.exe 1844 vznmmmdj.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exeaysdpzhcqi.exezdgexajzlbvwqfg.exevznmmmdj.execciavxhajwbdw.exevznmmmdj.exepid process 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4292 aysdpzhcqi.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4168 zdgexajzlbvwqfg.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 4200 vznmmmdj.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 3372 cciavxhajwbdw.exe 1844 vznmmmdj.exe 1844 vznmmmdj.exe 1844 vznmmmdj.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 3112 WINWORD.EXE 3112 WINWORD.EXE 3112 WINWORD.EXE 3112 WINWORD.EXE 3112 WINWORD.EXE 3112 WINWORD.EXE 3112 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exeaysdpzhcqi.exedescription pid process target process PID 4416 wrote to memory of 4292 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe aysdpzhcqi.exe PID 4416 wrote to memory of 4292 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe aysdpzhcqi.exe PID 4416 wrote to memory of 4292 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe aysdpzhcqi.exe PID 4416 wrote to memory of 4168 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe zdgexajzlbvwqfg.exe PID 4416 wrote to memory of 4168 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe zdgexajzlbvwqfg.exe PID 4416 wrote to memory of 4168 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe zdgexajzlbvwqfg.exe PID 4416 wrote to memory of 4200 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe vznmmmdj.exe PID 4416 wrote to memory of 4200 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe vznmmmdj.exe PID 4416 wrote to memory of 4200 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe vznmmmdj.exe PID 4416 wrote to memory of 3372 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe cciavxhajwbdw.exe PID 4416 wrote to memory of 3372 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe cciavxhajwbdw.exe PID 4416 wrote to memory of 3372 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe cciavxhajwbdw.exe PID 4292 wrote to memory of 1844 4292 aysdpzhcqi.exe vznmmmdj.exe PID 4292 wrote to memory of 1844 4292 aysdpzhcqi.exe vznmmmdj.exe PID 4292 wrote to memory of 1844 4292 aysdpzhcqi.exe vznmmmdj.exe PID 4416 wrote to memory of 3112 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe WINWORD.EXE PID 4416 wrote to memory of 3112 4416 66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe WINWORD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe"C:\Users\Admin\AppData\Local\Temp\66271b42deb125207e99f414b2f573f4a94f394cf70b02e7650c1a3359efb427.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\aysdpzhcqi.exeaysdpzhcqi.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vznmmmdj.exeC:\Windows\system32\vznmmmdj.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\zdgexajzlbvwqfg.exezdgexajzlbvwqfg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\vznmmmdj.exevznmmmdj.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cciavxhajwbdw.execciavxhajwbdw.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
6Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD5b1cb72ebde23246176cc78bab3c76905
SHA130bdafcc041681f18b33efffadd70dc74455df87
SHA25687342b8612e11031f475dabd67c3efa8d3b276176e0c1d8a189d3a31ecac5361
SHA512156dcf1cd574503d45d482920eb7f9cdbda2c0b00b169ab664616029714c673c08ccd5881d64e4471be521d179300f354f3ec5255124d46ebda58a872ebf181d
-
C:\Windows\SysWOW64\aysdpzhcqi.exeFilesize
255KB
MD586cd217eebe82d26d069831fb6dbe1e3
SHA1245561092b01a629ce8d084ea26c4a10addf48d7
SHA2566ab04e1574a9e2bc0d7b6e3cd8eab15c1d929ceb1148807d3d1d10cd3b40d1c4
SHA512a96acf9dc2cbb1e8f9b1a1efc5b33609c29946ad173721e0a7198604be7bbd6d5473b8dfca5c54bf7f8ac4c462efd2174d9155c673135ed38ca60504be0baed3
-
C:\Windows\SysWOW64\aysdpzhcqi.exeFilesize
255KB
MD586cd217eebe82d26d069831fb6dbe1e3
SHA1245561092b01a629ce8d084ea26c4a10addf48d7
SHA2566ab04e1574a9e2bc0d7b6e3cd8eab15c1d929ceb1148807d3d1d10cd3b40d1c4
SHA512a96acf9dc2cbb1e8f9b1a1efc5b33609c29946ad173721e0a7198604be7bbd6d5473b8dfca5c54bf7f8ac4c462efd2174d9155c673135ed38ca60504be0baed3
-
C:\Windows\SysWOW64\cciavxhajwbdw.exeFilesize
255KB
MD5ced9d1ffed18cca890364b421a4daaa2
SHA1f4f6ce3f4ce344074aa05a63b4796ab6515166c2
SHA2569ea2a017317cd33f4b987bb627eff04cdeff7fb53583c80cc53d78800f8753bd
SHA512500ccef2a6c66417e4fe0b7fe865f4e276af1c7435ddf69197364c7a7ede6628185815a84eb09b65ce7ed18dc003deb24b56db7c1a70049098390e53a5c2d937
-
C:\Windows\SysWOW64\cciavxhajwbdw.exeFilesize
255KB
MD5ced9d1ffed18cca890364b421a4daaa2
SHA1f4f6ce3f4ce344074aa05a63b4796ab6515166c2
SHA2569ea2a017317cd33f4b987bb627eff04cdeff7fb53583c80cc53d78800f8753bd
SHA512500ccef2a6c66417e4fe0b7fe865f4e276af1c7435ddf69197364c7a7ede6628185815a84eb09b65ce7ed18dc003deb24b56db7c1a70049098390e53a5c2d937
-
C:\Windows\SysWOW64\vznmmmdj.exeFilesize
255KB
MD5137bb97d5c00ca3105d2ef734735a2f7
SHA11c5af07149d6973fdfc92c3addb82e5d3761b906
SHA25669734a8cb0e78e0442415ca8146edba7509af4467c85bb1b5f3c146cd128f4af
SHA512e907a46b1a77a2452242b33d4535ef141a33906a6f34f7a508cae347e652968766e713156bb940e79d6837d3ffa58f07e02f8a4650169829067f970e66745858
-
C:\Windows\SysWOW64\vznmmmdj.exeFilesize
255KB
MD5137bb97d5c00ca3105d2ef734735a2f7
SHA11c5af07149d6973fdfc92c3addb82e5d3761b906
SHA25669734a8cb0e78e0442415ca8146edba7509af4467c85bb1b5f3c146cd128f4af
SHA512e907a46b1a77a2452242b33d4535ef141a33906a6f34f7a508cae347e652968766e713156bb940e79d6837d3ffa58f07e02f8a4650169829067f970e66745858
-
C:\Windows\SysWOW64\vznmmmdj.exeFilesize
255KB
MD5137bb97d5c00ca3105d2ef734735a2f7
SHA11c5af07149d6973fdfc92c3addb82e5d3761b906
SHA25669734a8cb0e78e0442415ca8146edba7509af4467c85bb1b5f3c146cd128f4af
SHA512e907a46b1a77a2452242b33d4535ef141a33906a6f34f7a508cae347e652968766e713156bb940e79d6837d3ffa58f07e02f8a4650169829067f970e66745858
-
C:\Windows\SysWOW64\zdgexajzlbvwqfg.exeFilesize
255KB
MD58e5bb980302903fa3189906dafedc97f
SHA1f0e029f9b56ca484afad46b2f5128850e93f5dc1
SHA256e2f481a5c720692f49c4a750558c9b4819f489bc2d792b3ed40b8633e19f758d
SHA51208db262265a6eb07501e460795dfcec0291cd94c96c2b4372f709f203f4c3f5c592e384f2e4a3b13f0098ab7f67162c7305478bfcc41c33a6516ba0ee145afed
-
C:\Windows\SysWOW64\zdgexajzlbvwqfg.exeFilesize
255KB
MD58e5bb980302903fa3189906dafedc97f
SHA1f0e029f9b56ca484afad46b2f5128850e93f5dc1
SHA256e2f481a5c720692f49c4a750558c9b4819f489bc2d792b3ed40b8633e19f758d
SHA51208db262265a6eb07501e460795dfcec0291cd94c96c2b4372f709f203f4c3f5c592e384f2e4a3b13f0098ab7f67162c7305478bfcc41c33a6516ba0ee145afed
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
255KB
MD5036bcc1b3eba697393f2d099a7357a15
SHA12bea86deb617b7405de0dc615df7b158770abc6a
SHA256a37876f0600742863b8291198bd4042ac65d1d8abbedd476bd5daae8a499542c
SHA51231f8d626023ef0aab88a27b053c6ae65c6cd043dd836538d7c01f54c7f96ba99ada107a4f7ca21100dedc3de4163cee812214c89d10e8dbfd7da8baa97080e74
-
memory/1844-159-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1844-152-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1844-150-0x0000000000000000-mapping.dmp
-
memory/3112-162-0x00007FFB6DCB0000-0x00007FFB6DCC0000-memory.dmpFilesize
64KB
-
memory/3112-172-0x00007FFB6DCB0000-0x00007FFB6DCC0000-memory.dmpFilesize
64KB
-
memory/3112-174-0x00007FFB6DCB0000-0x00007FFB6DCC0000-memory.dmpFilesize
64KB
-
memory/3112-163-0x00007FFB6DCB0000-0x00007FFB6DCC0000-memory.dmpFilesize
64KB
-
memory/3112-173-0x00007FFB6DCB0000-0x00007FFB6DCC0000-memory.dmpFilesize
64KB
-
memory/3112-165-0x00007FFB6DCB0000-0x00007FFB6DCC0000-memory.dmpFilesize
64KB
-
memory/3112-153-0x0000000000000000-mapping.dmp
-
memory/3112-164-0x00007FFB6DCB0000-0x00007FFB6DCC0000-memory.dmpFilesize
64KB
-
memory/3112-171-0x00007FFB6DCB0000-0x00007FFB6DCC0000-memory.dmpFilesize
64KB
-
memory/3112-168-0x00007FFB6B3B0000-0x00007FFB6B3C0000-memory.dmpFilesize
64KB
-
memory/3112-167-0x00007FFB6B3B0000-0x00007FFB6B3C0000-memory.dmpFilesize
64KB
-
memory/3112-166-0x00007FFB6DCB0000-0x00007FFB6DCC0000-memory.dmpFilesize
64KB
-
memory/3372-158-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3372-143-0x0000000000000000-mapping.dmp
-
memory/3372-149-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4168-137-0x0000000000000000-mapping.dmp
-
memory/4168-147-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4168-156-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4200-140-0x0000000000000000-mapping.dmp
-
memory/4200-157-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4200-148-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4292-134-0x0000000000000000-mapping.dmp
-
memory/4292-155-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4292-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4416-132-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4416-133-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4416-154-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB