Analysis
-
max time kernel
153s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 01:34
Behavioral task
behavioral1
Sample
33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe
Resource
win7-20220901-en
windows7-x64
26 signatures
150 seconds
General
-
Target
33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe
-
Size
255KB
-
MD5
9d9100137cbbdbbbd067fa86f31f3cad
-
SHA1
4850ff91328a6b7fa5895cc251c68011aed9feba
-
SHA256
33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb
-
SHA512
490ee466e8d288a70a167b05da97e334d9816c36c51a43ac3c57fdda899629c03942f199a2e79eafe40d6b6d6b089feb271e261e199192a981b4ef9ed13d22f1
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJV:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIk
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hfhvjmwfec.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hfhvjmwfec.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hfhvjmwfec.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hfhvjmwfec.exe -
Executes dropped EXE 5 IoCs
pid Process 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 644 wslbtlrh.exe 1812 tjuizorjoucmr.exe 3752 wslbtlrh.exe -
resource yara_rule behavioral2/files/0x0001000000022df6-133.dat upx behavioral2/files/0x0001000000022df6-134.dat upx behavioral2/files/0x0001000000022df7-137.dat upx behavioral2/memory/4752-139-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0001000000022df8-140.dat upx behavioral2/files/0x0001000000022df9-145.dat upx behavioral2/files/0x0001000000022df9-146.dat upx behavioral2/memory/4024-144-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0001000000022df8-141.dat upx behavioral2/memory/820-143-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0001000000022df7-136.dat upx behavioral2/memory/4752-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0001000000022df8-150.dat upx behavioral2/memory/644-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3752-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1812-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000300000001e635-161.dat upx behavioral2/files/0x000900000001e803-162.dat upx behavioral2/files/0x000900000001e803-163.dat upx behavioral2/memory/4024-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/820-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/644-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1812-168-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3752-169-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000200000001e6d5-170.dat upx behavioral2/files/0x000600000001da19-171.dat upx behavioral2/files/0x000600000001da19-172.dat upx behavioral2/memory/644-179-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3752-178-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" hfhvjmwfec.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run agwwvqqhuxyiplq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fqjzuucn = "hfhvjmwfec.exe" agwwvqqhuxyiplq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pyaocscl = "agwwvqqhuxyiplq.exe" agwwvqqhuxyiplq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tjuizorjoucmr.exe" agwwvqqhuxyiplq.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: wslbtlrh.exe File opened (read-only) \??\n: wslbtlrh.exe File opened (read-only) \??\j: hfhvjmwfec.exe File opened (read-only) \??\u: hfhvjmwfec.exe File opened (read-only) \??\r: wslbtlrh.exe File opened (read-only) \??\a: wslbtlrh.exe File opened (read-only) \??\s: hfhvjmwfec.exe File opened (read-only) \??\n: wslbtlrh.exe File opened (read-only) \??\t: wslbtlrh.exe File opened (read-only) \??\q: wslbtlrh.exe File opened (read-only) \??\v: wslbtlrh.exe File opened (read-only) \??\z: hfhvjmwfec.exe File opened (read-only) \??\v: wslbtlrh.exe File opened (read-only) \??\h: wslbtlrh.exe File opened (read-only) \??\p: hfhvjmwfec.exe File opened (read-only) \??\r: hfhvjmwfec.exe File opened (read-only) \??\w: hfhvjmwfec.exe File opened (read-only) \??\b: wslbtlrh.exe File opened (read-only) \??\j: wslbtlrh.exe File opened (read-only) \??\s: wslbtlrh.exe File opened (read-only) \??\x: wslbtlrh.exe File opened (read-only) \??\y: wslbtlrh.exe File opened (read-only) \??\u: wslbtlrh.exe File opened (read-only) \??\m: hfhvjmwfec.exe File opened (read-only) \??\h: wslbtlrh.exe File opened (read-only) \??\m: wslbtlrh.exe File opened (read-only) \??\g: wslbtlrh.exe File opened (read-only) \??\u: wslbtlrh.exe File opened (read-only) \??\l: wslbtlrh.exe File opened (read-only) \??\e: hfhvjmwfec.exe File opened (read-only) \??\h: hfhvjmwfec.exe File opened (read-only) \??\n: hfhvjmwfec.exe File opened (read-only) \??\t: hfhvjmwfec.exe File opened (read-only) \??\v: hfhvjmwfec.exe File opened (read-only) \??\p: wslbtlrh.exe File opened (read-only) \??\r: wslbtlrh.exe File opened (read-only) \??\f: hfhvjmwfec.exe File opened (read-only) \??\w: wslbtlrh.exe File opened (read-only) \??\f: wslbtlrh.exe File opened (read-only) \??\k: wslbtlrh.exe File opened (read-only) \??\w: wslbtlrh.exe File opened (read-only) \??\b: hfhvjmwfec.exe File opened (read-only) \??\e: wslbtlrh.exe File opened (read-only) \??\y: wslbtlrh.exe File opened (read-only) \??\g: wslbtlrh.exe File opened (read-only) \??\i: hfhvjmwfec.exe File opened (read-only) \??\q: hfhvjmwfec.exe File opened (read-only) \??\l: wslbtlrh.exe File opened (read-only) \??\q: wslbtlrh.exe File opened (read-only) \??\z: wslbtlrh.exe File opened (read-only) \??\o: wslbtlrh.exe File opened (read-only) \??\t: wslbtlrh.exe File opened (read-only) \??\i: wslbtlrh.exe File opened (read-only) \??\o: wslbtlrh.exe File opened (read-only) \??\l: hfhvjmwfec.exe File opened (read-only) \??\j: wslbtlrh.exe File opened (read-only) \??\a: hfhvjmwfec.exe File opened (read-only) \??\g: hfhvjmwfec.exe File opened (read-only) \??\o: hfhvjmwfec.exe File opened (read-only) \??\p: wslbtlrh.exe File opened (read-only) \??\k: hfhvjmwfec.exe File opened (read-only) \??\y: hfhvjmwfec.exe File opened (read-only) \??\k: wslbtlrh.exe File opened (read-only) \??\b: wslbtlrh.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" hfhvjmwfec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" hfhvjmwfec.exe -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4752-139-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4024-144-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/820-143-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4752-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/644-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3752-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1812-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4024-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/820-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/644-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1812-168-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3752-169-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/644-179-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3752-178-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\agwwvqqhuxyiplq.exe 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe File opened for modification C:\Windows\SysWOW64\agwwvqqhuxyiplq.exe 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe File opened for modification C:\Windows\SysWOW64\wslbtlrh.exe 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe File created C:\Windows\SysWOW64\tjuizorjoucmr.exe 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe wslbtlrh.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe wslbtlrh.exe File created C:\Windows\SysWOW64\hfhvjmwfec.exe 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe File opened for modification C:\Windows\SysWOW64\hfhvjmwfec.exe 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe File created C:\Windows\SysWOW64\wslbtlrh.exe 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe File opened for modification C:\Windows\SysWOW64\tjuizorjoucmr.exe 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll hfhvjmwfec.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe wslbtlrh.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wslbtlrh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wslbtlrh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal wslbtlrh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wslbtlrh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wslbtlrh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal wslbtlrh.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wslbtlrh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wslbtlrh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wslbtlrh.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wslbtlrh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe wslbtlrh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal wslbtlrh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe wslbtlrh.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal wslbtlrh.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe wslbtlrh.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe wslbtlrh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe wslbtlrh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe wslbtlrh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe wslbtlrh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe wslbtlrh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe wslbtlrh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe wslbtlrh.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe wslbtlrh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe wslbtlrh.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe wslbtlrh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe wslbtlrh.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe wslbtlrh.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe wslbtlrh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe wslbtlrh.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe wslbtlrh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" hfhvjmwfec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs hfhvjmwfec.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322C7E9C2182596A3676DD77212CD87DF464DA" 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB4FACAFE6AF2E7840F3A40819A3999B38A03FC4261034BE2CE42EC09D2" 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F768B4FE6E22A9D10CD1D28A7A9164" 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193FC77815E3DAB4B8BE7FE7EDE434BE" 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" hfhvjmwfec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB5B02947E2399952CABAA533E8D7CE" 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF5FF8D4F5C85189032D7287E97BDE7E13D584267446333D6ED" 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh hfhvjmwfec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg hfhvjmwfec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat hfhvjmwfec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" hfhvjmwfec.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" hfhvjmwfec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc hfhvjmwfec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf hfhvjmwfec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" hfhvjmwfec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" hfhvjmwfec.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1972 WINWORD.EXE 1972 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 4024 agwwvqqhuxyiplq.exe 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 820 hfhvjmwfec.exe 820 hfhvjmwfec.exe 820 hfhvjmwfec.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 4024 agwwvqqhuxyiplq.exe 4024 agwwvqqhuxyiplq.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 4024 agwwvqqhuxyiplq.exe 4024 agwwvqqhuxyiplq.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 3752 wslbtlrh.exe 3752 wslbtlrh.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 820 hfhvjmwfec.exe 820 hfhvjmwfec.exe 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 4024 agwwvqqhuxyiplq.exe 4024 agwwvqqhuxyiplq.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 3752 wslbtlrh.exe 3752 wslbtlrh.exe 3752 wslbtlrh.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 820 hfhvjmwfec.exe 820 hfhvjmwfec.exe 820 hfhvjmwfec.exe 4024 agwwvqqhuxyiplq.exe 4024 agwwvqqhuxyiplq.exe 4024 agwwvqqhuxyiplq.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 644 wslbtlrh.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 1812 tjuizorjoucmr.exe 3752 wslbtlrh.exe 3752 wslbtlrh.exe 3752 wslbtlrh.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1972 WINWORD.EXE 1972 WINWORD.EXE 1972 WINWORD.EXE 1972 WINWORD.EXE 1972 WINWORD.EXE 1972 WINWORD.EXE 1972 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4752 wrote to memory of 820 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 82 PID 4752 wrote to memory of 820 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 82 PID 4752 wrote to memory of 820 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 82 PID 4752 wrote to memory of 4024 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 83 PID 4752 wrote to memory of 4024 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 83 PID 4752 wrote to memory of 4024 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 83 PID 4752 wrote to memory of 644 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 84 PID 4752 wrote to memory of 644 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 84 PID 4752 wrote to memory of 644 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 84 PID 4752 wrote to memory of 1812 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 85 PID 4752 wrote to memory of 1812 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 85 PID 4752 wrote to memory of 1812 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 85 PID 4752 wrote to memory of 1972 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 86 PID 4752 wrote to memory of 1972 4752 33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe 86 PID 820 wrote to memory of 3752 820 hfhvjmwfec.exe 88 PID 820 wrote to memory of 3752 820 hfhvjmwfec.exe 88 PID 820 wrote to memory of 3752 820 hfhvjmwfec.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe"C:\Users\Admin\AppData\Local\Temp\33c2506ac112791a7bf4bbd4ca6207477c5e03693d40a28a170090504307f8bb.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\hfhvjmwfec.exehfhvjmwfec.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\wslbtlrh.exeC:\Windows\system32\wslbtlrh.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3752
-
-
-
C:\Windows\SysWOW64\agwwvqqhuxyiplq.exeagwwvqqhuxyiplq.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4024
-
-
C:\Windows\SysWOW64\wslbtlrh.exewslbtlrh.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:644
-
-
C:\Windows\SysWOW64\tjuizorjoucmr.exetjuizorjoucmr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1812
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1972
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD584c3d3243c580618182b5c534983638b
SHA15ddfc6c3cd37ca2be5b73309900bb9f2fa1b684f
SHA256c5d88fd14fb764be34644910ef8cb5959023e5811a1c32d502490ea95d99389b
SHA51278e51c3547dc5346b21b1d71873d8816deee6e6d7686032b441fcdffe0fbff77c5747eaca928673d2c207be9c419fb96e74c7e370e35c046c54e4299ed561933
-
Filesize
255KB
MD5fdb18ffd586cdb1f72f1046c61868913
SHA1f7d872ea65e6f13d6dcdc7a104e3c5729e0e3124
SHA25656f273d2cd057bb34da2921eaed90068d108ff934de0537b9ed7d1eedf0fe350
SHA512609699d67e63d702af0a9638df89c776a795033c2e8e16f07411e3581653cd9c10c867fc7a530e6f4dfb6eacb3d90bc348590e10a01b84594bd54504139cdc12
-
Filesize
255KB
MD5fdb18ffd586cdb1f72f1046c61868913
SHA1f7d872ea65e6f13d6dcdc7a104e3c5729e0e3124
SHA25656f273d2cd057bb34da2921eaed90068d108ff934de0537b9ed7d1eedf0fe350
SHA512609699d67e63d702af0a9638df89c776a795033c2e8e16f07411e3581653cd9c10c867fc7a530e6f4dfb6eacb3d90bc348590e10a01b84594bd54504139cdc12
-
Filesize
255KB
MD5559cbc41835686533d226cb0749bda5d
SHA1457ac565f5715ff8b19293ce3dbddd06b05b9e26
SHA2561ab98a5fe78868fc08fe2e35070aa383852f82d8f903f61dd837d1e4f5feb10f
SHA51283c3886212fa9430a91a512c3fa4180e86db6b2d9cce46089d0e3959d08a2913a28ffc0247e21adcc02fcee72e9ac47cd91a8cec018051e462df7a3d1ae23a62
-
Filesize
255KB
MD581715e27621f2776639f5a0d9a48ac8f
SHA1036492c8a0e4d4c929f323b9bec6830bcc77079a
SHA256854dd1e642cd5d0f3bc4cdf15c1d7d29cf079bd2b30d23cf6e548759281b1f0d
SHA5127bf39061c63a5d177081388658b93bd6bfe95dc4dc8a791b7e60735d479da8363c763200efb4c9c508d88009ead42329509fab31eeea560bec24da0ac5e11493
-
Filesize
255KB
MD581715e27621f2776639f5a0d9a48ac8f
SHA1036492c8a0e4d4c929f323b9bec6830bcc77079a
SHA256854dd1e642cd5d0f3bc4cdf15c1d7d29cf079bd2b30d23cf6e548759281b1f0d
SHA5127bf39061c63a5d177081388658b93bd6bfe95dc4dc8a791b7e60735d479da8363c763200efb4c9c508d88009ead42329509fab31eeea560bec24da0ac5e11493
-
Filesize
255KB
MD50a0af86230cc485b2231410aded7809c
SHA1afca88272ff12f1300c0781a74fdbb6a5036324c
SHA256b9ccde63daa9f2baf37a42e9578290a7eba7ddbf5ee65d104448286efc828a45
SHA5123bf9e1d6f67eb1708040e258fd105aa84e26523cd9ef9baf05627d9e06107bef71bb15d79d67af8fbf5dd88770110104383347dd52f30a8b663c212d89a298f6
-
Filesize
255KB
MD50a0af86230cc485b2231410aded7809c
SHA1afca88272ff12f1300c0781a74fdbb6a5036324c
SHA256b9ccde63daa9f2baf37a42e9578290a7eba7ddbf5ee65d104448286efc828a45
SHA5123bf9e1d6f67eb1708040e258fd105aa84e26523cd9ef9baf05627d9e06107bef71bb15d79d67af8fbf5dd88770110104383347dd52f30a8b663c212d89a298f6
-
Filesize
255KB
MD57e18db62aa9df4d0d695c9e7503d8a95
SHA1767a58f13dff42c17b21d7caaeb18df081f1b273
SHA256646e65ea92957434223260ab0f5db5b193b09b4f7d2b4a3a895cdc0b93e6bdbb
SHA512432915402b3c022bf57ce75adb449dde8108d67001979293b047f56196c88041ccda2634e1ba18d7934469a5508fc2612f388bf56402d575d7b8ffcd3d1f4fcb
-
Filesize
255KB
MD57e18db62aa9df4d0d695c9e7503d8a95
SHA1767a58f13dff42c17b21d7caaeb18df081f1b273
SHA256646e65ea92957434223260ab0f5db5b193b09b4f7d2b4a3a895cdc0b93e6bdbb
SHA512432915402b3c022bf57ce75adb449dde8108d67001979293b047f56196c88041ccda2634e1ba18d7934469a5508fc2612f388bf56402d575d7b8ffcd3d1f4fcb
-
Filesize
255KB
MD57734dcb6e116a9cc7b00d9e8f5b762cd
SHA135a029c59a6585971eea79e2b9609a65edcda9d9
SHA256f5bc2d820a07c55d2d3f99c37c8240aa436dd498a5d024a17c4b645f0b19dc5b
SHA51291e681a2871e9e4d395e230184e45eff7bcb1f157abfacc5e29dfde4c7bf8aaf1980e48c4c3b4cb5d6dcd3ad39ed499ab9e84ed62bda82452e3b1aa9e846ad3d
-
Filesize
255KB
MD57734dcb6e116a9cc7b00d9e8f5b762cd
SHA135a029c59a6585971eea79e2b9609a65edcda9d9
SHA256f5bc2d820a07c55d2d3f99c37c8240aa436dd498a5d024a17c4b645f0b19dc5b
SHA51291e681a2871e9e4d395e230184e45eff7bcb1f157abfacc5e29dfde4c7bf8aaf1980e48c4c3b4cb5d6dcd3ad39ed499ab9e84ed62bda82452e3b1aa9e846ad3d
-
Filesize
255KB
MD57734dcb6e116a9cc7b00d9e8f5b762cd
SHA135a029c59a6585971eea79e2b9609a65edcda9d9
SHA256f5bc2d820a07c55d2d3f99c37c8240aa436dd498a5d024a17c4b645f0b19dc5b
SHA51291e681a2871e9e4d395e230184e45eff7bcb1f157abfacc5e29dfde4c7bf8aaf1980e48c4c3b4cb5d6dcd3ad39ed499ab9e84ed62bda82452e3b1aa9e846ad3d
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD597f1c072dc6a1682a83b6b5d79066c4c
SHA1ead2fbbc505580ac9a4365962ceab6f918bf0cdc
SHA256e49e84c106915a7d4e91a351965ea83baee82154815f1ac1ba4d4973074030a6
SHA5124de30efd8cba751f3bea17c9503afd6d34b2c4ad76f8fc3639d6ae60ae3a179a09d66845a90d1c66c37d06b45bf87ad8051f9b5976b40f0169ae69a7376c8f09
-
Filesize
255KB
MD5c5a33c405938e716cad00faa9a192f01
SHA1858625d34f10965108fea2a641430eddaac6856c
SHA25601ae108ccaa1178c6b14196afd2ae7858f1b0a9d09d4d88af61616b6a6765ea8
SHA512b83e852fbebac3244fca2b17b45012f3c24aa354db2bd44352b29d8ea2d4ed3f058565190953a5e429d4e99ca391df4cf9f71e8db0b982cc2318eb92656da26b