604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b

Analysis

max time kernel
268s
max time network
290s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Size

255KB
MD5

36aced954a82292490e98f4ce0ca5720
SHA1

857fd81aa5a71b6e1e47e121eace3a968f2ee374
SHA256

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b
SHA512

ee2a10e5e8832919390ffe7659113aac5f1693e768cfa7d584c7390bffcf1ce5b3cde195bcace85bb0934ae7f7ae00580fd2e184871f47f56fa34acbb05c68ef
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJY:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIH

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

egapkvazaa.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	egapkvazaa.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

egapkvazaa.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	egapkvazaa.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

egapkvazaa.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	egapkvazaa.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

egapkvazaa.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	egapkvazaa.exe

Executes dropped EXE 5 IoCs

Processes:

egapkvazaa.exetnyxmqrgctvommx.exetqrbioqm.exedoevrsootfbbz.exetqrbioqm.exe

pid process

2416 egapkvazaa.exe
4368 tnyxmqrgctvommx.exe
4320 tqrbioqm.exe
2976 doevrsootfbbz.exe
5044 tqrbioqm.exe

pid	process
2416	egapkvazaa.exe
4368	tnyxmqrgctvommx.exe
4320	tqrbioqm.exe
2976	doevrsootfbbz.exe
5044	tqrbioqm.exe

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2396-132-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\egapkvazaa.exe	upx
C:\Windows\SysWOW64\tnyxmqrgctvommx.exe	upx
C:\Windows\SysWOW64\tqrbioqm.exe	upx
C:\Windows\SysWOW64\doevrsootfbbz.exe	upx
C:\Windows\SysWOW64\doevrsootfbbz.exe	upx
C:\Windows\SysWOW64\tqrbioqm.exe	upx
C:\Windows\SysWOW64\tnyxmqrgctvommx.exe	upx
C:\Windows\SysWOW64\egapkvazaa.exe	upx
behavioral2/memory/2416-145-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/4320-147-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/2976-148-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/4368-146-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/2396-150-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\tqrbioqm.exe	upx
behavioral2/memory/5044-153-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/2416-154-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/4368-155-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/4320-156-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/2976-157-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	upx
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

egapkvazaa.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	egapkvazaa.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

tnyxmqrgctvommx.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vmniawqk = "egapkvazaa.exe"	tnyxmqrgctvommx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\clbhpiui = "tnyxmqrgctvommx.exe"	tnyxmqrgctvommx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "doevrsootfbbz.exe"	tnyxmqrgctvommx.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	tnyxmqrgctvommx.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

tqrbioqm.exetqrbioqm.exeegapkvazaa.exe

description	ioc	process
File opened (read-only)	\??\j:	tqrbioqm.exe
File opened (read-only)	\??\k:	tqrbioqm.exe
File opened (read-only)	\??\t:	tqrbioqm.exe
File opened (read-only)	\??\z:	tqrbioqm.exe
File opened (read-only)	\??\x:	egapkvazaa.exe
File opened (read-only)	\??\i:	tqrbioqm.exe
File opened (read-only)	\??\o:	egapkvazaa.exe
File opened (read-only)	\??\n:	tqrbioqm.exe
File opened (read-only)	\??\x:	tqrbioqm.exe
File opened (read-only)	\??\z:	tqrbioqm.exe
File opened (read-only)	\??\e:	tqrbioqm.exe
File opened (read-only)	\??\i:	tqrbioqm.exe
File opened (read-only)	\??\a:	egapkvazaa.exe
File opened (read-only)	\??\g:	egapkvazaa.exe
File opened (read-only)	\??\q:	egapkvazaa.exe
File opened (read-only)	\??\k:	tqrbioqm.exe
File opened (read-only)	\??\m:	tqrbioqm.exe
File opened (read-only)	\??\r:	tqrbioqm.exe
File opened (read-only)	\??\n:	egapkvazaa.exe
File opened (read-only)	\??\r:	tqrbioqm.exe
File opened (read-only)	\??\y:	tqrbioqm.exe
File opened (read-only)	\??\t:	egapkvazaa.exe
File opened (read-only)	\??\e:	tqrbioqm.exe
File opened (read-only)	\??\h:	tqrbioqm.exe
File opened (read-only)	\??\m:	tqrbioqm.exe
File opened (read-only)	\??\j:	egapkvazaa.exe
File opened (read-only)	\??\o:	tqrbioqm.exe
File opened (read-only)	\??\v:	tqrbioqm.exe
File opened (read-only)	\??\w:	tqrbioqm.exe
File opened (read-only)	\??\x:	tqrbioqm.exe
File opened (read-only)	\??\y:	tqrbioqm.exe
File opened (read-only)	\??\h:	egapkvazaa.exe
File opened (read-only)	\??\g:	tqrbioqm.exe
File opened (read-only)	\??\w:	tqrbioqm.exe
File opened (read-only)	\??\a:	tqrbioqm.exe
File opened (read-only)	\??\b:	tqrbioqm.exe
File opened (read-only)	\??\i:	egapkvazaa.exe
File opened (read-only)	\??\k:	egapkvazaa.exe
File opened (read-only)	\??\l:	egapkvazaa.exe
File opened (read-only)	\??\n:	tqrbioqm.exe
File opened (read-only)	\??\q:	tqrbioqm.exe
File opened (read-only)	\??\b:	egapkvazaa.exe
File opened (read-only)	\??\t:	tqrbioqm.exe
File opened (read-only)	\??\g:	tqrbioqm.exe
File opened (read-only)	\??\u:	tqrbioqm.exe
File opened (read-only)	\??\e:	egapkvazaa.exe
File opened (read-only)	\??\f:	tqrbioqm.exe
File opened (read-only)	\??\j:	tqrbioqm.exe
File opened (read-only)	\??\f:	egapkvazaa.exe
File opened (read-only)	\??\p:	egapkvazaa.exe
File opened (read-only)	\??\z:	egapkvazaa.exe
File opened (read-only)	\??\q:	tqrbioqm.exe
File opened (read-only)	\??\h:	tqrbioqm.exe
File opened (read-only)	\??\o:	tqrbioqm.exe
File opened (read-only)	\??\p:	tqrbioqm.exe
File opened (read-only)	\??\y:	egapkvazaa.exe
File opened (read-only)	\??\f:	tqrbioqm.exe
File opened (read-only)	\??\s:	tqrbioqm.exe
File opened (read-only)	\??\s:	egapkvazaa.exe
File opened (read-only)	\??\u:	egapkvazaa.exe
File opened (read-only)	\??\p:	tqrbioqm.exe
File opened (read-only)	\??\a:	tqrbioqm.exe
File opened (read-only)	\??\l:	tqrbioqm.exe
File opened (read-only)	\??\v:	egapkvazaa.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

egapkvazaa.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	egapkvazaa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	egapkvazaa.exe

AutoIT Executable 10 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/2416-145-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4320-147-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/2976-148-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4368-146-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/2396-150-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/5044-153-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/2416-154-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4368-155-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4320-156-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/2976-157-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

egapkvazaa.exe604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	egapkvazaa.exe
File opened for modification	C:\Windows\SysWOW64\egapkvazaa.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File created	C:\Windows\SysWOW64\tnyxmqrgctvommx.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File opened for modification	C:\Windows\SysWOW64\tnyxmqrgctvommx.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File created	C:\Windows\SysWOW64\tqrbioqm.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File opened for modification	C:\Windows\SysWOW64\tqrbioqm.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File created	C:\Windows\SysWOW64\doevrsootfbbz.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File opened for modification	C:\Windows\SysWOW64\doevrsootfbbz.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
File created	C:\Windows\SysWOW64\egapkvazaa.exe	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

Drops file in Program Files directory 14 IoCs

Processes:

tqrbioqm.exetqrbioqm.exe

description	ioc	process
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	tqrbioqm.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal	tqrbioqm.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	tqrbioqm.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal	tqrbioqm.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	tqrbioqm.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	tqrbioqm.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	tqrbioqm.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	tqrbioqm.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal	tqrbioqm.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	tqrbioqm.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe	tqrbioqm.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	tqrbioqm.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe	tqrbioqm.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal	tqrbioqm.exe

Drops file in Windows directory 1 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

description ioc process

File opened for modification C:\Windows\mydoc.rtf 604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

Modifies registry class 20 IoCs

Processes:

egapkvazaa.exe604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	egapkvazaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	egapkvazaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	egapkvazaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	egapkvazaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	egapkvazaa.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB0B02B4497399953BEBADD33EDD7CB"	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF5FF88485C82689041D65D7DE1BDE2E636594167456345D69E"	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	egapkvazaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	egapkvazaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	egapkvazaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33462C7F9C5782246A3777D670272DAD7D8F64D8"	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC8FABAFE64F291837D3A4081993996B08C03F042150349E1BA42ED09A2"	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F76BB8FE6A21D1D208D1A98B789161"	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183AC67D15E0DAB3B9BB7C92ECE234B9"	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	egapkvazaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	egapkvazaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	egapkvazaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	egapkvazaa.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeegapkvazaa.exetqrbioqm.exetnyxmqrgctvommx.exedoevrsootfbbz.exetqrbioqm.exe

pid	process
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeegapkvazaa.exetnyxmqrgctvommx.exetqrbioqm.exedoevrsootfbbz.exetqrbioqm.exe

pid	process
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeegapkvazaa.exetnyxmqrgctvommx.exetqrbioqm.exedoevrsootfbbz.exetqrbioqm.exe

pid	process
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
2416	egapkvazaa.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4368	tnyxmqrgctvommx.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
4320	tqrbioqm.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
2976	doevrsootfbbz.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe
5044	tqrbioqm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

WINWORD.EXE

pid process

3024 WINWORD.EXE

pid	process
3024	WINWORD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exeegapkvazaa.exe

description	pid	process	target process
PID 2396 wrote to memory of 2416	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	egapkvazaa.exe
PID 2396 wrote to memory of 2416	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	egapkvazaa.exe
PID 2396 wrote to memory of 2416	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	egapkvazaa.exe
PID 2396 wrote to memory of 4368	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	tnyxmqrgctvommx.exe
PID 2396 wrote to memory of 4368	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	tnyxmqrgctvommx.exe
PID 2396 wrote to memory of 4368	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	tnyxmqrgctvommx.exe
PID 2396 wrote to memory of 4320	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	tqrbioqm.exe
PID 2396 wrote to memory of 4320	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	tqrbioqm.exe
PID 2396 wrote to memory of 4320	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	tqrbioqm.exe
PID 2396 wrote to memory of 2976	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	doevrsootfbbz.exe
PID 2396 wrote to memory of 2976	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	doevrsootfbbz.exe
PID 2396 wrote to memory of 2976	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	doevrsootfbbz.exe
PID 2396 wrote to memory of 3024	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	WINWORD.EXE
PID 2396 wrote to memory of 3024	2396	604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe	WINWORD.EXE
PID 2416 wrote to memory of 5044	2416	egapkvazaa.exe	tqrbioqm.exe
PID 2416 wrote to memory of 5044	2416	egapkvazaa.exe	tqrbioqm.exe
PID 2416 wrote to memory of 5044	2416	egapkvazaa.exe	tqrbioqm.exe

C:\Users\Admin\AppData\Local\Temp\604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe
"C:\Users\Admin\AppData\Local\Temp\604235a8923bcc41529c7662f5dc0b5e3be2f720e9b9ff15344f453cc9b3115b.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\egapkvazaa.exe
egapkvazaa.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\tqrbioqm.exe
C:\Windows\system32\tqrbioqm.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5044

C:\Windows\SysWOW64\tnyxmqrgctvommx.exe
tnyxmqrgctvommx.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4368

C:\Windows\SysWOW64\tqrbioqm.exe
tqrbioqm.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4320

C:\Windows\SysWOW64\doevrsootfbbz.exe
doevrsootfbbz.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2976

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
2⤵
- Suspicious use of SetWindowsHookEx
PID:3024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
0f54ad67251f1e5c64424b278f4c7b94

SHA1
9406a2370817d5fcf1123c3df8b41ec81b343e80

SHA256
1472d3691dd18c6e25a90a4de0d6af8f95344ed7ccb695375e0aeef41d357b7e

SHA512
e2138bf64f9c924e4c8d0f6849b1b835baa21ac96610085986c4e6fc297b93cc517c317a6620f6664cda042c451738edaa2b60ec98b2416319f72cc06ea919b3

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
40f99a618f70e6514636992dcba0c907

SHA1
b5bb3986ae4339648d3043ea46c8471fa3e93d2b

SHA256
8a49883f7aef54e25fff6b5110ad585c2b182f0aa3aba68c79f749b8c021c9e4

SHA512
ad79d750d20216962ce50e9dafd9c370baf4306c8d1398aa35b22577a5212c1b6f75b4fe1ec5231ac0a21638a2bba764a7441732382ac893f3dac576f86f0ccb

Download Submit
C:\Windows\SysWOW64\doevrsootfbbz.exe

Filesize
255KB

MD5
841e48a9062607a95456751f6a3ea7b4

SHA1
3d60faa49fc19f29a34b9b605639fcd9958481b7

SHA256
cff705437e45bfdc014c248060ece51ea113bc7bfda43b92e35fba341755cb78

SHA512
43c7745a6aa38351d4e301aefa95104e9827be198c6b9cae5b584508c2d6386a4f765a57094535091330e75343e14f10835937418e0d880e5c21a9c1f173aa4f

Download Submit
C:\Windows\SysWOW64\doevrsootfbbz.exe

Filesize
255KB

MD5
841e48a9062607a95456751f6a3ea7b4

SHA1
3d60faa49fc19f29a34b9b605639fcd9958481b7

SHA256
cff705437e45bfdc014c248060ece51ea113bc7bfda43b92e35fba341755cb78

SHA512
43c7745a6aa38351d4e301aefa95104e9827be198c6b9cae5b584508c2d6386a4f765a57094535091330e75343e14f10835937418e0d880e5c21a9c1f173aa4f

Download Submit
C:\Windows\SysWOW64\egapkvazaa.exe

Filesize
255KB

MD5
1cd446183eb914923ad345bb9a71f033

SHA1
c3a301b2ae400a72bc515183e1dc10bbd8528171

SHA256
6cb0ebe4c1260f3328d6a8566b823e44115c4328fc17ca85183b9a7cd0d5d8c1

SHA512
53d5a483d10ca6c6e5b9360aac843b1304092034a53964f518fe551cc1884c3389d28a97c548f4fe312e7008289e221a0dab308dd10efb56d83201726c7847df

Download Submit
C:\Windows\SysWOW64\egapkvazaa.exe

Filesize
255KB

MD5
1cd446183eb914923ad345bb9a71f033

SHA1
c3a301b2ae400a72bc515183e1dc10bbd8528171

SHA256
6cb0ebe4c1260f3328d6a8566b823e44115c4328fc17ca85183b9a7cd0d5d8c1

SHA512
53d5a483d10ca6c6e5b9360aac843b1304092034a53964f518fe551cc1884c3389d28a97c548f4fe312e7008289e221a0dab308dd10efb56d83201726c7847df

Download Submit
C:\Windows\SysWOW64\tnyxmqrgctvommx.exe

Filesize
255KB

MD5
6b08d4e5bef0ba4dbf1a79d30da0602e

SHA1
fdeddc41bf8e2268dc01fe6f43dc24f4e44dcc95

SHA256
a18fdec21231eff1316e4b1ae29a1265bd7f465741b3710080e24075e567ea04

SHA512
f75c12e1dcd79dd50fcaac1d229585b57970c97e2dd8bbaa44e4887e83961a7b21c9b9ce14a8f4263f05a56e9b38e538c339b21e72675bed40cccd30475358d2

Download Submit
C:\Windows\SysWOW64\tnyxmqrgctvommx.exe

Filesize
255KB

MD5
6b08d4e5bef0ba4dbf1a79d30da0602e

SHA1
fdeddc41bf8e2268dc01fe6f43dc24f4e44dcc95

SHA256
a18fdec21231eff1316e4b1ae29a1265bd7f465741b3710080e24075e567ea04

SHA512
f75c12e1dcd79dd50fcaac1d229585b57970c97e2dd8bbaa44e4887e83961a7b21c9b9ce14a8f4263f05a56e9b38e538c339b21e72675bed40cccd30475358d2

Download Submit
C:\Windows\SysWOW64\tqrbioqm.exe

Filesize
255KB

MD5
d62c16b167d33ce84abb5289fb0e949b

SHA1
9a5f8042ff14e983fb8d190e4df4a6077e496273

SHA256
bf3bf84494d501e73562db5be81a29bfd0f75047cb8d1d8ebb4661aa8cb71638

SHA512
0f46616bbe8c3fd3fb4ac565d858c79fb131fa8e883e1d7b6e7bfa39d8d6e8bfd2fd304bd542b0810e286514c343c3bd90cca5c98afb4a2bb16ecf6195dca66f

Download Submit
C:\Windows\SysWOW64\tqrbioqm.exe

Filesize
255KB

MD5
d62c16b167d33ce84abb5289fb0e949b

SHA1
9a5f8042ff14e983fb8d190e4df4a6077e496273

SHA256
bf3bf84494d501e73562db5be81a29bfd0f75047cb8d1d8ebb4661aa8cb71638

SHA512
0f46616bbe8c3fd3fb4ac565d858c79fb131fa8e883e1d7b6e7bfa39d8d6e8bfd2fd304bd542b0810e286514c343c3bd90cca5c98afb4a2bb16ecf6195dca66f

Download Submit
C:\Windows\SysWOW64\tqrbioqm.exe

Filesize
255KB

MD5
d62c16b167d33ce84abb5289fb0e949b

SHA1
9a5f8042ff14e983fb8d190e4df4a6077e496273

SHA256
bf3bf84494d501e73562db5be81a29bfd0f75047cb8d1d8ebb4661aa8cb71638

SHA512
0f46616bbe8c3fd3fb4ac565d858c79fb131fa8e883e1d7b6e7bfa39d8d6e8bfd2fd304bd542b0810e286514c343c3bd90cca5c98afb4a2bb16ecf6195dca66f

Download Submit
memory/2396-150-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2396-132-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2416-154-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2416-133-0x0000000000000000-mapping.dmp

Download
memory/2416-145-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2976-141-0x0000000000000000-mapping.dmp

Download
memory/2976-148-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2976-157-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/3024-162-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/3024-166-0x00007FF864080000-0x00007FF864090000-memory.dmp

Filesize
64KB

Download
memory/3024-161-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/3024-165-0x00007FF864080000-0x00007FF864090000-memory.dmp

Filesize
64KB

Download
memory/3024-160-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/3024-159-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/3024-149-0x0000000000000000-mapping.dmp

Download
memory/3024-158-0x00007FF866290000-0x00007FF8662A0000-memory.dmp

Filesize
64KB

Download
memory/4320-156-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4320-147-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4320-138-0x0000000000000000-mapping.dmp

Download
memory/4368-155-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4368-146-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4368-136-0x0000000000000000-mapping.dmp

Download
memory/5044-153-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/5044-151-0x0000000000000000-mapping.dmp

Download