Analysis
-
max time kernel
204s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 23:32
Behavioral task
behavioral1
Sample
3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe
Resource
win7-20221111-en
windows7-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe
-
Size
255KB
-
MD5
8dc30e039d1da94726f6c3b93d1ea4e4
-
SHA1
b87e6719437bebed4ca45b7dd2f0837b523f97ca
-
SHA256
3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4
-
SHA512
8ff689ccbe31f64cd798adc9b00a5382aef658869204103a1bacc27fee45ce5b73f8a5c14a4878def33781541367d3814943e3602b0eecb117f50327215a94d9
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJB:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIk
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fjipvtjemw.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fjipvtjemw.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fjipvtjemw.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fjipvtjemw.exe -
Executes dropped EXE 5 IoCs
pid Process 1780 fjipvtjemw.exe 3868 ddleduoylqydiyv.exe 4964 cskldfyq.exe 1036 zrpmztvldseot.exe 316 cskldfyq.exe -
resource yara_rule behavioral2/memory/1508-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000900000002317b-134.dat upx behavioral2/files/0x000900000002317b-135.dat upx behavioral2/files/0x0009000000023197-137.dat upx behavioral2/files/0x0008000000023198-140.dat upx behavioral2/files/0x0009000000023197-138.dat upx behavioral2/files/0x0008000000023198-141.dat upx behavioral2/files/0x0008000000023199-143.dat upx behavioral2/files/0x0008000000023199-144.dat upx behavioral2/memory/1780-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3868-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4964-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1036-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1508-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0008000000023198-151.dat upx behavioral2/memory/1508-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/316-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1780-155-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3868-156-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4964-157-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1036-158-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/316-159-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0008000000022645-166.dat upx behavioral2/files/0x0008000000022645-165.dat upx behavioral2/files/0x000900000002319f-167.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fjipvtjemw.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ddleduoylqydiyv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oqxzcyic = "fjipvtjemw.exe" ddleduoylqydiyv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\czqarlly = "ddleduoylqydiyv.exe" ddleduoylqydiyv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "zrpmztvldseot.exe" ddleduoylqydiyv.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: cskldfyq.exe File opened (read-only) \??\u: cskldfyq.exe File opened (read-only) \??\p: cskldfyq.exe File opened (read-only) \??\z: cskldfyq.exe File opened (read-only) \??\n: cskldfyq.exe File opened (read-only) \??\b: fjipvtjemw.exe File opened (read-only) \??\k: cskldfyq.exe File opened (read-only) \??\q: cskldfyq.exe File opened (read-only) \??\v: cskldfyq.exe File opened (read-only) \??\x: cskldfyq.exe File opened (read-only) \??\u: fjipvtjemw.exe File opened (read-only) \??\r: cskldfyq.exe File opened (read-only) \??\h: fjipvtjemw.exe File opened (read-only) \??\i: fjipvtjemw.exe File opened (read-only) \??\q: fjipvtjemw.exe File opened (read-only) \??\v: fjipvtjemw.exe File opened (read-only) \??\n: cskldfyq.exe File opened (read-only) \??\a: fjipvtjemw.exe File opened (read-only) \??\g: fjipvtjemw.exe File opened (read-only) \??\p: fjipvtjemw.exe File opened (read-only) \??\w: fjipvtjemw.exe File opened (read-only) \??\a: cskldfyq.exe File opened (read-only) \??\w: cskldfyq.exe File opened (read-only) \??\h: cskldfyq.exe File opened (read-only) \??\q: cskldfyq.exe File opened (read-only) \??\t: fjipvtjemw.exe File opened (read-only) \??\x: cskldfyq.exe File opened (read-only) \??\o: cskldfyq.exe File opened (read-only) \??\m: cskldfyq.exe File opened (read-only) \??\i: cskldfyq.exe File opened (read-only) \??\w: cskldfyq.exe File opened (read-only) \??\x: fjipvtjemw.exe File opened (read-only) \??\t: cskldfyq.exe File opened (read-only) \??\y: cskldfyq.exe File opened (read-only) \??\f: cskldfyq.exe File opened (read-only) \??\k: cskldfyq.exe File opened (read-only) \??\s: cskldfyq.exe File opened (read-only) \??\u: cskldfyq.exe File opened (read-only) \??\s: fjipvtjemw.exe File opened (read-only) \??\e: cskldfyq.exe File opened (read-only) \??\o: cskldfyq.exe File opened (read-only) \??\j: cskldfyq.exe File opened (read-only) \??\l: cskldfyq.exe File opened (read-only) \??\p: cskldfyq.exe File opened (read-only) \??\y: cskldfyq.exe File opened (read-only) \??\f: fjipvtjemw.exe File opened (read-only) \??\k: fjipvtjemw.exe File opened (read-only) \??\f: cskldfyq.exe File opened (read-only) \??\v: cskldfyq.exe File opened (read-only) \??\e: cskldfyq.exe File opened (read-only) \??\g: cskldfyq.exe File opened (read-only) \??\t: cskldfyq.exe File opened (read-only) \??\e: fjipvtjemw.exe File opened (read-only) \??\j: fjipvtjemw.exe File opened (read-only) \??\l: fjipvtjemw.exe File opened (read-only) \??\g: cskldfyq.exe File opened (read-only) \??\s: cskldfyq.exe File opened (read-only) \??\a: cskldfyq.exe File opened (read-only) \??\n: fjipvtjemw.exe File opened (read-only) \??\r: fjipvtjemw.exe File opened (read-only) \??\h: cskldfyq.exe File opened (read-only) \??\i: cskldfyq.exe File opened (read-only) \??\j: cskldfyq.exe File opened (read-only) \??\r: cskldfyq.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" fjipvtjemw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" fjipvtjemw.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1780-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3868-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4964-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1036-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1508-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1508-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/316-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1780-155-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3868-156-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4964-157-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1036-158-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/316-159-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ddleduoylqydiyv.exe 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe File opened for modification C:\Windows\SysWOW64\cskldfyq.exe 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe File created C:\Windows\SysWOW64\zrpmztvldseot.exe 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe File created C:\Windows\SysWOW64\fjipvtjemw.exe 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe File opened for modification C:\Windows\SysWOW64\fjipvtjemw.exe 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe File opened for modification C:\Windows\SysWOW64\zrpmztvldseot.exe 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fjipvtjemw.exe File created C:\Windows\SysWOW64\ddleduoylqydiyv.exe 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe File created C:\Windows\SysWOW64\cskldfyq.exe 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cskldfyq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cskldfyq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cskldfyq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cskldfyq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cskldfyq.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cskldfyq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cskldfyq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cskldfyq.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cskldfyq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cskldfyq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cskldfyq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cskldfyq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cskldfyq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cskldfyq.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78768B4FF6C22A9D273D1A78A099110" 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat fjipvtjemw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" fjipvtjemw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf fjipvtjemw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs fjipvtjemw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" fjipvtjemw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg fjipvtjemw.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B02947E539EE53CABAD4339CD4BC" 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FFBFCFC4F5B851C9032D6587E93BDE1E136584467426331D690" 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" fjipvtjemw.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh fjipvtjemw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc fjipvtjemw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" fjipvtjemw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33452C0D9C2082246D4377D470552CDB7D8365DE" 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC8FAB0F961F1E583743A4486ED3E98B0FA038A4261033DE1BE45E909D3" 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183AC77B14E3DAC5B9BD7CE8ED9237B9" 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" fjipvtjemw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" fjipvtjemw.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4496 WINWORD.EXE 4496 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 4964 cskldfyq.exe 3868 ddleduoylqydiyv.exe 4964 cskldfyq.exe 3868 ddleduoylqydiyv.exe 4964 cskldfyq.exe 4964 cskldfyq.exe 4964 cskldfyq.exe 4964 cskldfyq.exe 4964 cskldfyq.exe 4964 cskldfyq.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 4964 cskldfyq.exe 4964 cskldfyq.exe 4964 cskldfyq.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 316 cskldfyq.exe 316 cskldfyq.exe 316 cskldfyq.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 1780 fjipvtjemw.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 3868 ddleduoylqydiyv.exe 4964 cskldfyq.exe 4964 cskldfyq.exe 4964 cskldfyq.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 1036 zrpmztvldseot.exe 316 cskldfyq.exe 316 cskldfyq.exe 316 cskldfyq.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4496 WINWORD.EXE 4496 WINWORD.EXE 4496 WINWORD.EXE 4496 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1508 wrote to memory of 1780 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 80 PID 1508 wrote to memory of 1780 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 80 PID 1508 wrote to memory of 1780 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 80 PID 1508 wrote to memory of 3868 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 81 PID 1508 wrote to memory of 3868 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 81 PID 1508 wrote to memory of 3868 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 81 PID 1508 wrote to memory of 4964 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 82 PID 1508 wrote to memory of 4964 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 82 PID 1508 wrote to memory of 4964 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 82 PID 1508 wrote to memory of 1036 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 83 PID 1508 wrote to memory of 1036 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 83 PID 1508 wrote to memory of 1036 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 83 PID 1780 wrote to memory of 316 1780 fjipvtjemw.exe 84 PID 1780 wrote to memory of 316 1780 fjipvtjemw.exe 84 PID 1780 wrote to memory of 316 1780 fjipvtjemw.exe 84 PID 1508 wrote to memory of 4496 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 85 PID 1508 wrote to memory of 4496 1508 3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe"C:\Users\Admin\AppData\Local\Temp\3a592b61d15d727295230c83577db358a55c5304cb4e919d3385487189addfc4.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\fjipvtjemw.exefjipvtjemw.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cskldfyq.exeC:\Windows\system32\cskldfyq.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:316
-
-
-
C:\Windows\SysWOW64\ddleduoylqydiyv.exeddleduoylqydiyv.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3868
-
-
C:\Windows\SysWOW64\cskldfyq.execskldfyq.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4964
-
-
C:\Windows\SysWOW64\zrpmztvldseot.exezrpmztvldseot.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1036
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4496
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5547347e3eb0fbc54ae909e7d6da36aba
SHA1ee1d39cf0efb53e54c609a3f0e90a38dcb1fa1e4
SHA256259f0291f870684c38341cb18aa545b8256c3a667fb9c6847f1d857a739d14bc
SHA512be4668c5613b4311c84d20993a42dc7c268512c2554ade9d85195188f6db97697c614680b3dda3259ab1f99dd32c161412c4e0d18ab5d4cf88e8b6152c94f3b1
-
Filesize
255KB
MD5900d682b83b98d2a6f9496b9bda4d2ae
SHA19f12160a8898be8de2f156efe928fc22ff46e719
SHA2561ef73c412095743bcbe019d5f60c49ed7846805b14ce8b428a7ad4fc4f216302
SHA512b4d1076d8e7842a2ca480de026bd1b00792c0751af2b1568ad2f3fe7cea44c5ae08121d5e4c62e98ed8a7ffb2dcf8c010c1dc57a450e206039bed84eb7749749
-
Filesize
255KB
MD5900d682b83b98d2a6f9496b9bda4d2ae
SHA19f12160a8898be8de2f156efe928fc22ff46e719
SHA2561ef73c412095743bcbe019d5f60c49ed7846805b14ce8b428a7ad4fc4f216302
SHA512b4d1076d8e7842a2ca480de026bd1b00792c0751af2b1568ad2f3fe7cea44c5ae08121d5e4c62e98ed8a7ffb2dcf8c010c1dc57a450e206039bed84eb7749749
-
Filesize
255KB
MD5900d682b83b98d2a6f9496b9bda4d2ae
SHA19f12160a8898be8de2f156efe928fc22ff46e719
SHA2561ef73c412095743bcbe019d5f60c49ed7846805b14ce8b428a7ad4fc4f216302
SHA512b4d1076d8e7842a2ca480de026bd1b00792c0751af2b1568ad2f3fe7cea44c5ae08121d5e4c62e98ed8a7ffb2dcf8c010c1dc57a450e206039bed84eb7749749
-
Filesize
255KB
MD5f8feb96ff233e5c82be3b188f136adf2
SHA17c27bd95a0ad83af5123b57c96c90013dbaf6b2b
SHA2563a690e4dad54755f0553de7cb5e6eb6565d169e6cb85e3031c349b83c90b7c99
SHA5127b31b786e07b2367ec0c899cdb6efda4b4aa8627b7a892821b5aae550b8f4f32b281db4c0d7b5460d105bb9b9dcd4f9995e7ad800f4c38535715e259f52da196
-
Filesize
255KB
MD5f8feb96ff233e5c82be3b188f136adf2
SHA17c27bd95a0ad83af5123b57c96c90013dbaf6b2b
SHA2563a690e4dad54755f0553de7cb5e6eb6565d169e6cb85e3031c349b83c90b7c99
SHA5127b31b786e07b2367ec0c899cdb6efda4b4aa8627b7a892821b5aae550b8f4f32b281db4c0d7b5460d105bb9b9dcd4f9995e7ad800f4c38535715e259f52da196
-
Filesize
255KB
MD5a15b528dcee63272364cdc53c394c48a
SHA176f93009ce455e871b191a5e8ae1499a49fc21f0
SHA256686329267c4904cb3b439a10afc19cc8c413a71c758cb039661a0567bc6702ce
SHA51251f26deea473b610002f3dfc7bd0e3c2dd71ab59170fc47eca2459b1766c8bd3e608ea99dafdfd586c1d7e124a8896592ded3816d7ff5e872b28ef0134092346
-
Filesize
255KB
MD5a15b528dcee63272364cdc53c394c48a
SHA176f93009ce455e871b191a5e8ae1499a49fc21f0
SHA256686329267c4904cb3b439a10afc19cc8c413a71c758cb039661a0567bc6702ce
SHA51251f26deea473b610002f3dfc7bd0e3c2dd71ab59170fc47eca2459b1766c8bd3e608ea99dafdfd586c1d7e124a8896592ded3816d7ff5e872b28ef0134092346
-
Filesize
255KB
MD573f7b4f3cf422b119488811e3d8f10e3
SHA13d08d9e5b2ef1417c0a0920bef0ca26ee3d99b06
SHA256be785839f760a34c95e06708eb2a792bcac66945e8e0d57841d5c42081a3f255
SHA512bd20f953fd0fa9867ad564f6f4dfd508800f52b8e78a0dfec6240f070a88a9627d86cf930f24742afdc501a05a62fb5b372a046cdc32a54c52e327660eec71e2
-
Filesize
255KB
MD573f7b4f3cf422b119488811e3d8f10e3
SHA13d08d9e5b2ef1417c0a0920bef0ca26ee3d99b06
SHA256be785839f760a34c95e06708eb2a792bcac66945e8e0d57841d5c42081a3f255
SHA512bd20f953fd0fa9867ad564f6f4dfd508800f52b8e78a0dfec6240f070a88a9627d86cf930f24742afdc501a05a62fb5b372a046cdc32a54c52e327660eec71e2
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD56c2a20a3eb65a0a160bf81dd8d89cd93
SHA17885567d38f5ca019e48210bcb0dcdcde17384ec
SHA256749ec4c513e6878d9955e473a1ef4a617f5515604233e29276195910fcbd76fb
SHA5124f53dd28eaabf4b3f15a14dcc9b60c29abaf56844261ce8b34e308b7b1abfcca9b0ca460e1e504784e0932e95e5d669896478849ad78cde1ccb374601f93eadf
-
Filesize
255KB
MD56c2a20a3eb65a0a160bf81dd8d89cd93
SHA17885567d38f5ca019e48210bcb0dcdcde17384ec
SHA256749ec4c513e6878d9955e473a1ef4a617f5515604233e29276195910fcbd76fb
SHA5124f53dd28eaabf4b3f15a14dcc9b60c29abaf56844261ce8b34e308b7b1abfcca9b0ca460e1e504784e0932e95e5d669896478849ad78cde1ccb374601f93eadf