Analysis
-
max time kernel
174s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:07
Behavioral task
behavioral1
Sample
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe
Resource
win10v2004-20221111-en
General
-
Target
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe
-
Size
255KB
-
MD5
4ed00b378e088fe0b54b0e2096a6ba92
-
SHA1
eb908caa6b99f0e7f3bfd8dff93449f489c95a98
-
SHA256
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531
-
SHA512
45ec6f62d8b2e95696df53bf6edc86559b99672d13131064279db0def37c124062fad8bc192569165fe1d49c59df878e541b1918780223d3b8b33da3a002e6b8
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJp:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIo
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
tquuallrqt.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tquuallrqt.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
tquuallrqt.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tquuallrqt.exe -
Processes:
tquuallrqt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tquuallrqt.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
tquuallrqt.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tquuallrqt.exe -
Executes dropped EXE 5 IoCs
Processes:
tquuallrqt.exexgjklqlnjbiklan.exemmolgcvf.exegxoxrskiwcmxz.exemmolgcvf.exepid process 2156 tquuallrqt.exe 1220 xgjklqlnjbiklan.exe 1800 mmolgcvf.exe 3024 gxoxrskiwcmxz.exe 4300 mmolgcvf.exe -
Processes:
resource yara_rule behavioral2/memory/1432-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\tquuallrqt.exe upx C:\Windows\SysWOW64\tquuallrqt.exe upx C:\Windows\SysWOW64\xgjklqlnjbiklan.exe upx C:\Windows\SysWOW64\xgjklqlnjbiklan.exe upx C:\Windows\SysWOW64\mmolgcvf.exe upx C:\Windows\SysWOW64\mmolgcvf.exe upx C:\Windows\SysWOW64\gxoxrskiwcmxz.exe upx C:\Windows\SysWOW64\gxoxrskiwcmxz.exe upx behavioral2/memory/2156-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1220-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1800-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3024-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1220-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1800-150-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3024-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\mmolgcvf.exe upx behavioral2/memory/4300-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1432-156-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx behavioral2/memory/4300-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe -
Processes:
tquuallrqt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tquuallrqt.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
xgjklqlnjbiklan.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run xgjklqlnjbiklan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owlkdkqx = "tquuallrqt.exe" xgjklqlnjbiklan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tqlzdcnh = "xgjklqlnjbiklan.exe" xgjklqlnjbiklan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gxoxrskiwcmxz.exe" xgjklqlnjbiklan.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
mmolgcvf.exetquuallrqt.exemmolgcvf.exedescription ioc process File opened (read-only) \??\r: mmolgcvf.exe File opened (read-only) \??\x: tquuallrqt.exe File opened (read-only) \??\g: mmolgcvf.exe File opened (read-only) \??\b: tquuallrqt.exe File opened (read-only) \??\s: mmolgcvf.exe File opened (read-only) \??\y: mmolgcvf.exe File opened (read-only) \??\z: mmolgcvf.exe File opened (read-only) \??\b: mmolgcvf.exe File opened (read-only) \??\f: mmolgcvf.exe File opened (read-only) \??\v: mmolgcvf.exe File opened (read-only) \??\f: tquuallrqt.exe File opened (read-only) \??\l: tquuallrqt.exe File opened (read-only) \??\y: tquuallrqt.exe File opened (read-only) \??\b: mmolgcvf.exe File opened (read-only) \??\t: mmolgcvf.exe File opened (read-only) \??\l: mmolgcvf.exe File opened (read-only) \??\q: mmolgcvf.exe File opened (read-only) \??\a: mmolgcvf.exe File opened (read-only) \??\w: mmolgcvf.exe File opened (read-only) \??\a: mmolgcvf.exe File opened (read-only) \??\r: tquuallrqt.exe File opened (read-only) \??\w: tquuallrqt.exe File opened (read-only) \??\e: mmolgcvf.exe File opened (read-only) \??\m: mmolgcvf.exe File opened (read-only) \??\p: mmolgcvf.exe File opened (read-only) \??\k: mmolgcvf.exe File opened (read-only) \??\t: mmolgcvf.exe File opened (read-only) \??\w: mmolgcvf.exe File opened (read-only) \??\x: mmolgcvf.exe File opened (read-only) \??\a: tquuallrqt.exe File opened (read-only) \??\g: tquuallrqt.exe File opened (read-only) \??\e: mmolgcvf.exe File opened (read-only) \??\j: mmolgcvf.exe File opened (read-only) \??\m: mmolgcvf.exe File opened (read-only) \??\n: mmolgcvf.exe File opened (read-only) \??\p: mmolgcvf.exe File opened (read-only) \??\e: tquuallrqt.exe File opened (read-only) \??\j: mmolgcvf.exe File opened (read-only) \??\z: tquuallrqt.exe File opened (read-only) \??\f: mmolgcvf.exe File opened (read-only) \??\g: mmolgcvf.exe File opened (read-only) \??\i: mmolgcvf.exe File opened (read-only) \??\h: tquuallrqt.exe File opened (read-only) \??\s: tquuallrqt.exe File opened (read-only) \??\s: mmolgcvf.exe File opened (read-only) \??\q: tquuallrqt.exe File opened (read-only) \??\v: tquuallrqt.exe File opened (read-only) \??\r: mmolgcvf.exe File opened (read-only) \??\x: mmolgcvf.exe File opened (read-only) \??\n: mmolgcvf.exe File opened (read-only) \??\o: mmolgcvf.exe File opened (read-only) \??\l: mmolgcvf.exe File opened (read-only) \??\k: tquuallrqt.exe File opened (read-only) \??\t: tquuallrqt.exe File opened (read-only) \??\z: mmolgcvf.exe File opened (read-only) \??\i: tquuallrqt.exe File opened (read-only) \??\m: tquuallrqt.exe File opened (read-only) \??\o: mmolgcvf.exe File opened (read-only) \??\u: mmolgcvf.exe File opened (read-only) \??\v: mmolgcvf.exe File opened (read-only) \??\u: tquuallrqt.exe File opened (read-only) \??\y: mmolgcvf.exe File opened (read-only) \??\o: tquuallrqt.exe File opened (read-only) \??\n: tquuallrqt.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
tquuallrqt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" tquuallrqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" tquuallrqt.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1432-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2156-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1220-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1800-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3024-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1220-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1800-150-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3024-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4300-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1432-156-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4300-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exetquuallrqt.exedescription ioc process File created C:\Windows\SysWOW64\gxoxrskiwcmxz.exe 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe File created C:\Windows\SysWOW64\mmolgcvf.exe 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe File opened for modification C:\Windows\SysWOW64\tquuallrqt.exe 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe File created C:\Windows\SysWOW64\xgjklqlnjbiklan.exe 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe File opened for modification C:\Windows\SysWOW64\xgjklqlnjbiklan.exe 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe File opened for modification C:\Windows\SysWOW64\mmolgcvf.exe 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe File opened for modification C:\Windows\SysWOW64\gxoxrskiwcmxz.exe 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll tquuallrqt.exe File created C:\Windows\SysWOW64\tquuallrqt.exe 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe -
Drops file in Program Files directory 15 IoCs
Processes:
mmolgcvf.exemmolgcvf.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mmolgcvf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mmolgcvf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mmolgcvf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mmolgcvf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mmolgcvf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mmolgcvf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mmolgcvf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mmolgcvf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mmolgcvf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mmolgcvf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mmolgcvf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mmolgcvf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mmolgcvf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mmolgcvf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mmolgcvf.exe -
Drops file in Windows directory 3 IoCs
Processes:
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
tquuallrqt.exe1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh tquuallrqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" tquuallrqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs tquuallrqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" tquuallrqt.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B15C47E139EE53C9BAD13393D7B9" 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78768B2FE6821AAD20FD0A58B789062" 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1944C7091597DBB1B8C07CE7ED9034BA" 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf tquuallrqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg tquuallrqt.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFACAF967F192837C3A40869739E6B0FC028F43610332E1B9429A08A4" 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat tquuallrqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFC8F482F82199041D65D7DE5BDE4E635594467336236D69E" 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" tquuallrqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" tquuallrqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" tquuallrqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472D799D2C82236A4676DC70532DDC7C8F65DD" 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" tquuallrqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc tquuallrqt.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3628 WINWORD.EXE 3628 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exexgjklqlnjbiklan.exetquuallrqt.exemmolgcvf.exegxoxrskiwcmxz.exepid process 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe -
Suspicious use of FindShellTrayWindow 19 IoCs
Processes:
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exetquuallrqt.exexgjklqlnjbiklan.exemmolgcvf.exegxoxrskiwcmxz.exemmolgcvf.exepid process 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 4300 mmolgcvf.exe 4300 mmolgcvf.exe 4300 mmolgcvf.exe -
Suspicious use of SendNotifyMessage 19 IoCs
Processes:
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exetquuallrqt.exexgjklqlnjbiklan.exemmolgcvf.exegxoxrskiwcmxz.exemmolgcvf.exepid process 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 2156 tquuallrqt.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1220 xgjklqlnjbiklan.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 1800 mmolgcvf.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 3024 gxoxrskiwcmxz.exe 4300 mmolgcvf.exe 4300 mmolgcvf.exe 4300 mmolgcvf.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 3628 WINWORD.EXE 3628 WINWORD.EXE 3628 WINWORD.EXE 3628 WINWORD.EXE 3628 WINWORD.EXE 3628 WINWORD.EXE 3628 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exetquuallrqt.exedescription pid process target process PID 1432 wrote to memory of 2156 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe tquuallrqt.exe PID 1432 wrote to memory of 2156 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe tquuallrqt.exe PID 1432 wrote to memory of 2156 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe tquuallrqt.exe PID 1432 wrote to memory of 1220 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe xgjklqlnjbiklan.exe PID 1432 wrote to memory of 1220 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe xgjklqlnjbiklan.exe PID 1432 wrote to memory of 1220 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe xgjklqlnjbiklan.exe PID 1432 wrote to memory of 1800 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe mmolgcvf.exe PID 1432 wrote to memory of 1800 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe mmolgcvf.exe PID 1432 wrote to memory of 1800 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe mmolgcvf.exe PID 1432 wrote to memory of 3024 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe gxoxrskiwcmxz.exe PID 1432 wrote to memory of 3024 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe gxoxrskiwcmxz.exe PID 1432 wrote to memory of 3024 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe gxoxrskiwcmxz.exe PID 2156 wrote to memory of 4300 2156 tquuallrqt.exe mmolgcvf.exe PID 2156 wrote to memory of 4300 2156 tquuallrqt.exe mmolgcvf.exe PID 2156 wrote to memory of 4300 2156 tquuallrqt.exe mmolgcvf.exe PID 1432 wrote to memory of 3628 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe WINWORD.EXE PID 1432 wrote to memory of 3628 1432 1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe WINWORD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe"C:\Users\Admin\AppData\Local\Temp\1171030265f35b3c24b2dac53494b7fb69edd28dff69ea7bf53bead80642d531.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tquuallrqt.exetquuallrqt.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mmolgcvf.exeC:\Windows\system32\mmolgcvf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\gxoxrskiwcmxz.exegxoxrskiwcmxz.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\mmolgcvf.exemmolgcvf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\xgjklqlnjbiklan.exexgjklqlnjbiklan.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
6Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
255KB
MD504059f58324cf10a0b0914cbf506db33
SHA18af2062440c7441ece56e936b98afbc0f7252f9a
SHA256a42b31c9195ae2bdbe9b4df2d6c8cf8d165abe5c3fb44f2190f5331067d831d9
SHA5124197d0ad6bd4fcdbccc3534478b1da16822829329b06380336d9a3ddf2bcabdac55376ad1b62f5025770fb94ee9348216a8e09def00acb3051255db6a1082821
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD5ee6cd82150deda4e8744923bc61c2910
SHA1346d8571d127403c5e1752b06a49b8686da78397
SHA256585251797534b4dcc017bd255ef3bb2751df08eee592b9038d16d5b5444f3b5b
SHA512a24ef13c15f6703375ca82c0a11515ba101c26fbf892ace8ca0f5cc7e0cd2ae90de44e9fa6bb636f640af70a98d1ce9612bb86bd7a738477f597d275f8b2c8b8
-
C:\Windows\SysWOW64\gxoxrskiwcmxz.exeFilesize
255KB
MD5a3b95f43c8b259773c85779a6d4be053
SHA10bf8795fc4660516b1bb568bb2d6213dda8b2f07
SHA256d3f0b27036d0ec32a42be2464ab33011f7e6866a92547c778e362d151ed05f54
SHA51274fff64edaa225fd50293339b781272b85ffc039c1e41aed3fb3d8e2f8a574f6f02e91b93bd98b9d5c1b89917dc259cabfcaabded56c13a210c2e6f83b258ce0
-
C:\Windows\SysWOW64\gxoxrskiwcmxz.exeFilesize
255KB
MD5a3b95f43c8b259773c85779a6d4be053
SHA10bf8795fc4660516b1bb568bb2d6213dda8b2f07
SHA256d3f0b27036d0ec32a42be2464ab33011f7e6866a92547c778e362d151ed05f54
SHA51274fff64edaa225fd50293339b781272b85ffc039c1e41aed3fb3d8e2f8a574f6f02e91b93bd98b9d5c1b89917dc259cabfcaabded56c13a210c2e6f83b258ce0
-
C:\Windows\SysWOW64\mmolgcvf.exeFilesize
255KB
MD5feadbb2c878ae39085ce5e5162767fda
SHA117ff6e08b3a4d0b5b5786cf8177d52b1b2f20624
SHA2560ee0b45063154f64072bc628c854d4baa8925cff83930ecff9b5224461a45e3e
SHA512017c1f1b7dc664355e051f814215e8e96362636082c6d468fc4c8d91ea9c6df9452f3a2923bfd966ceeaf22498d9419bdc526ea0ae15f9fad156b77dec563167
-
C:\Windows\SysWOW64\mmolgcvf.exeFilesize
255KB
MD5feadbb2c878ae39085ce5e5162767fda
SHA117ff6e08b3a4d0b5b5786cf8177d52b1b2f20624
SHA2560ee0b45063154f64072bc628c854d4baa8925cff83930ecff9b5224461a45e3e
SHA512017c1f1b7dc664355e051f814215e8e96362636082c6d468fc4c8d91ea9c6df9452f3a2923bfd966ceeaf22498d9419bdc526ea0ae15f9fad156b77dec563167
-
C:\Windows\SysWOW64\mmolgcvf.exeFilesize
255KB
MD5feadbb2c878ae39085ce5e5162767fda
SHA117ff6e08b3a4d0b5b5786cf8177d52b1b2f20624
SHA2560ee0b45063154f64072bc628c854d4baa8925cff83930ecff9b5224461a45e3e
SHA512017c1f1b7dc664355e051f814215e8e96362636082c6d468fc4c8d91ea9c6df9452f3a2923bfd966ceeaf22498d9419bdc526ea0ae15f9fad156b77dec563167
-
C:\Windows\SysWOW64\tquuallrqt.exeFilesize
255KB
MD5545da200afea2029d51deaf8e133161a
SHA15648bb83080202111585e68c1435e67d416fac37
SHA256c083eca63e451a263935d68246a8f2aedb82104c6cf8382a2660bf52dad07c15
SHA512473682e9cc2174191b82207cc1e99a886330615006e504614fa85a5422a1bbebb33cc28948b0cd798ae2c49689e331e07167fb331b8c1fa42c26a8ec7c5f2a51
-
C:\Windows\SysWOW64\tquuallrqt.exeFilesize
255KB
MD5545da200afea2029d51deaf8e133161a
SHA15648bb83080202111585e68c1435e67d416fac37
SHA256c083eca63e451a263935d68246a8f2aedb82104c6cf8382a2660bf52dad07c15
SHA512473682e9cc2174191b82207cc1e99a886330615006e504614fa85a5422a1bbebb33cc28948b0cd798ae2c49689e331e07167fb331b8c1fa42c26a8ec7c5f2a51
-
C:\Windows\SysWOW64\xgjklqlnjbiklan.exeFilesize
255KB
MD5456dcac9a36bed8a522ef4efaf1a6de6
SHA1e4157da6ce4a837ca7d3a83690fa081e88f477d7
SHA256e1e6b3138ac9e6fa5fdfe09c57ea6aed1b5f8b6295e39b112c2111c2ca81d609
SHA5124ab4cd51a9b1229810482321bfef60e359279e484827720b9b7739b9020c24de028bf594ce8e548d9eda19d35de44f7446c55d68cff471b1986d1d8428fa20dc
-
C:\Windows\SysWOW64\xgjklqlnjbiklan.exeFilesize
255KB
MD5456dcac9a36bed8a522ef4efaf1a6de6
SHA1e4157da6ce4a837ca7d3a83690fa081e88f477d7
SHA256e1e6b3138ac9e6fa5fdfe09c57ea6aed1b5f8b6295e39b112c2111c2ca81d609
SHA5124ab4cd51a9b1229810482321bfef60e359279e484827720b9b7739b9020c24de028bf594ce8e548d9eda19d35de44f7446c55d68cff471b1986d1d8428fa20dc
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
memory/1220-136-0x0000000000000000-mapping.dmp
-
memory/1220-149-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1220-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1432-156-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1432-132-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1800-150-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1800-147-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1800-139-0x0000000000000000-mapping.dmp
-
memory/2156-133-0x0000000000000000-mapping.dmp
-
memory/2156-145-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3024-148-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3024-151-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3024-142-0x0000000000000000-mapping.dmp
-
memory/3628-158-0x00007FF7EFBB0000-0x00007FF7EFBC0000-memory.dmpFilesize
64KB
-
memory/3628-157-0x00007FF7EFBB0000-0x00007FF7EFBC0000-memory.dmpFilesize
64KB
-
memory/3628-159-0x00007FF7EFBB0000-0x00007FF7EFBC0000-memory.dmpFilesize
64KB
-
memory/3628-160-0x00007FF7EFBB0000-0x00007FF7EFBC0000-memory.dmpFilesize
64KB
-
memory/3628-161-0x00007FF7EFBB0000-0x00007FF7EFBC0000-memory.dmpFilesize
64KB
-
memory/3628-155-0x0000000000000000-mapping.dmp
-
memory/3628-164-0x00007FF7ED250000-0x00007FF7ED260000-memory.dmpFilesize
64KB
-
memory/3628-165-0x00007FF7ED250000-0x00007FF7ED260000-memory.dmpFilesize
64KB
-
memory/4300-154-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4300-166-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4300-152-0x0000000000000000-mapping.dmp