Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
176s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 06:50
Behavioral task
behavioral1
Sample
f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
Resource
win7-20221111-en
windows7-x64
26 signatures
150 seconds
General
-
Target
f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
-
Size
255KB
-
MD5
959659d0dad9d478b5e9300adf841e94
-
SHA1
30821776c716ec7506f0d8951c5a782a601eef9d
-
SHA256
f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c
-
SHA512
603a1c6060882c44870e2122594ec510f31446679aae09c4158bad2a156b537473cf0fd7df3f66c0d21d9cddb2ecc9aee456f7381437c843ff4bcc46c23f8d87
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJe:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIR
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" gkakzukczw.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gkakzukczw.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gkakzukczw.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gkakzukczw.exe -
Executes dropped EXE 5 IoCs
pid Process 3800 gkakzukczw.exe 2772 riqmbndjsblkcld.exe 2184 mouarejx.exe 4864 iwubldzpfwbjk.exe 1860 mouarejx.exe -
resource yara_rule behavioral2/memory/3492-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0008000000022def-134.dat upx behavioral2/files/0x0008000000022def-135.dat upx behavioral2/files/0x0007000000022e02-138.dat upx behavioral2/files/0x0007000000022e02-137.dat upx behavioral2/files/0x0007000000022e03-143.dat upx behavioral2/files/0x0007000000022e04-146.dat upx behavioral2/files/0x0007000000022e04-145.dat upx behavioral2/files/0x0007000000022e03-144.dat upx behavioral2/memory/2772-141-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3800-139-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2184-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4864-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000022e03-150.dat upx behavioral2/memory/1860-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3492-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000022e08-159.dat upx behavioral2/files/0x0007000000022e09-161.dat upx behavioral2/files/0x0007000000022e09-160.dat upx behavioral2/memory/3800-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2772-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2184-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4864-168-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1860-169-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0009000000022e14-170.dat upx behavioral2/files/0x0013000000022de4-171.dat upx behavioral2/files/0x0013000000022de4-172.dat upx behavioral2/files/0x0013000000022de4-173.dat upx behavioral2/files/0x0013000000022de4-174.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gkakzukczw.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run riqmbndjsblkcld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rxkluvjs = "gkakzukczw.exe" riqmbndjsblkcld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vlhmiadx = "riqmbndjsblkcld.exe" riqmbndjsblkcld.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "iwubldzpfwbjk.exe" riqmbndjsblkcld.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\h: mouarejx.exe File opened (read-only) \??\x: mouarejx.exe File opened (read-only) \??\k: mouarejx.exe File opened (read-only) \??\o: mouarejx.exe File opened (read-only) \??\h: gkakzukczw.exe File opened (read-only) \??\z: gkakzukczw.exe File opened (read-only) \??\f: mouarejx.exe File opened (read-only) \??\n: mouarejx.exe File opened (read-only) \??\g: mouarejx.exe File opened (read-only) \??\i: mouarejx.exe File opened (read-only) \??\k: mouarejx.exe File opened (read-only) \??\e: mouarejx.exe File opened (read-only) \??\f: mouarejx.exe File opened (read-only) \??\w: mouarejx.exe File opened (read-only) \??\m: gkakzukczw.exe File opened (read-only) \??\i: gkakzukczw.exe File opened (read-only) \??\a: mouarejx.exe File opened (read-only) \??\n: mouarejx.exe File opened (read-only) \??\v: mouarejx.exe File opened (read-only) \??\g: gkakzukczw.exe File opened (read-only) \??\y: mouarejx.exe File opened (read-only) \??\z: mouarejx.exe File opened (read-only) \??\l: mouarejx.exe File opened (read-only) \??\m: mouarejx.exe File opened (read-only) \??\m: mouarejx.exe File opened (read-only) \??\u: mouarejx.exe File opened (read-only) \??\j: mouarejx.exe File opened (read-only) \??\r: mouarejx.exe File opened (read-only) \??\g: mouarejx.exe File opened (read-only) \??\i: mouarejx.exe File opened (read-only) \??\q: mouarejx.exe File opened (read-only) \??\b: mouarejx.exe File opened (read-only) \??\z: mouarejx.exe File opened (read-only) \??\t: gkakzukczw.exe File opened (read-only) \??\s: mouarejx.exe File opened (read-only) \??\w: mouarejx.exe File opened (read-only) \??\q: mouarejx.exe File opened (read-only) \??\v: mouarejx.exe File opened (read-only) \??\h: mouarejx.exe File opened (read-only) \??\p: mouarejx.exe File opened (read-only) \??\r: mouarejx.exe File opened (read-only) \??\e: gkakzukczw.exe File opened (read-only) \??\s: mouarejx.exe File opened (read-only) \??\t: mouarejx.exe File opened (read-only) \??\l: mouarejx.exe File opened (read-only) \??\p: mouarejx.exe File opened (read-only) \??\y: gkakzukczw.exe File opened (read-only) \??\j: mouarejx.exe File opened (read-only) \??\b: gkakzukczw.exe File opened (read-only) \??\j: gkakzukczw.exe File opened (read-only) \??\n: gkakzukczw.exe File opened (read-only) \??\o: mouarejx.exe File opened (read-only) \??\t: mouarejx.exe File opened (read-only) \??\x: mouarejx.exe File opened (read-only) \??\k: gkakzukczw.exe File opened (read-only) \??\w: gkakzukczw.exe File opened (read-only) \??\e: mouarejx.exe File opened (read-only) \??\o: gkakzukczw.exe File opened (read-only) \??\s: gkakzukczw.exe File opened (read-only) \??\v: gkakzukczw.exe File opened (read-only) \??\a: mouarejx.exe File opened (read-only) \??\u: mouarejx.exe File opened (read-only) \??\f: gkakzukczw.exe File opened (read-only) \??\b: mouarejx.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" gkakzukczw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" gkakzukczw.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2772-141-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3800-139-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2184-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4864-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1860-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3492-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3800-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2772-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2184-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4864-168-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1860-169-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mouarejx.exe f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe File opened for modification C:\Windows\SysWOW64\iwubldzpfwbjk.exe f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll gkakzukczw.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mouarejx.exe File opened for modification C:\Windows\SysWOW64\gkakzukczw.exe f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe File created C:\Windows\SysWOW64\riqmbndjsblkcld.exe f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe File opened for modification C:\Windows\SysWOW64\riqmbndjsblkcld.exe f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mouarejx.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe mouarejx.exe File created C:\Windows\SysWOW64\gkakzukczw.exe f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe File created C:\Windows\SysWOW64\mouarejx.exe f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe File created C:\Windows\SysWOW64\iwubldzpfwbjk.exe f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mouarejx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mouarejx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mouarejx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mouarejx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mouarejx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mouarejx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mouarejx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mouarejx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mouarejx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mouarejx.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mouarejx.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mouarejx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mouarejx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mouarejx.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mouarejx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mouarejx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mouarejx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mouarejx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe mouarejx.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mouarejx.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mouarejx.exe File opened for modification C:\Windows\mydoc.rtf f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe mouarejx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" gkakzukczw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" gkakzukczw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc gkakzukczw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" gkakzukczw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg gkakzukczw.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B15A449239E352CCBAD7329FD4CE" f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF8FCFB4F5C85139134D7587EE6BC94E134584067456334D79F" f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat gkakzukczw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf gkakzukczw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" gkakzukczw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33442C0A9C5783546D3677D570562CDD7C8465DE" f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCEFABDFE17F194830B3B30869F39E2B38C028F43640332E1CD42EC08D5" f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F368C4FE6F21ABD10CD1A88A089010" f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193DC67D1593DAB6B8CD7CE5EDE537BA" f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh gkakzukczw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" gkakzukczw.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs gkakzukczw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" gkakzukczw.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3468 WINWORD.EXE 3468 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3800 gkakzukczw.exe 2772 riqmbndjsblkcld.exe 3800 gkakzukczw.exe 2772 riqmbndjsblkcld.exe 2772 riqmbndjsblkcld.exe 2772 riqmbndjsblkcld.exe 3800 gkakzukczw.exe 2772 riqmbndjsblkcld.exe 2772 riqmbndjsblkcld.exe 3800 gkakzukczw.exe 2772 riqmbndjsblkcld.exe 2772 riqmbndjsblkcld.exe 3800 gkakzukczw.exe 3800 gkakzukczw.exe 3800 gkakzukczw.exe 2772 riqmbndjsblkcld.exe 3800 gkakzukczw.exe 2772 riqmbndjsblkcld.exe 3800 gkakzukczw.exe 3800 gkakzukczw.exe 2184 mouarejx.exe 2184 mouarejx.exe 2184 mouarejx.exe 2184 mouarejx.exe 2184 mouarejx.exe 2184 mouarejx.exe 2184 mouarejx.exe 2184 mouarejx.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 2772 riqmbndjsblkcld.exe 2772 riqmbndjsblkcld.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 1860 mouarejx.exe 1860 mouarejx.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3800 gkakzukczw.exe 3800 gkakzukczw.exe 3800 gkakzukczw.exe 2772 riqmbndjsblkcld.exe 2772 riqmbndjsblkcld.exe 2772 riqmbndjsblkcld.exe 2184 mouarejx.exe 2184 mouarejx.exe 2184 mouarejx.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 1860 mouarejx.exe 1860 mouarejx.exe 1860 mouarejx.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 3800 gkakzukczw.exe 3800 gkakzukczw.exe 3800 gkakzukczw.exe 2772 riqmbndjsblkcld.exe 2772 riqmbndjsblkcld.exe 2772 riqmbndjsblkcld.exe 2184 mouarejx.exe 2184 mouarejx.exe 2184 mouarejx.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 4864 iwubldzpfwbjk.exe 1860 mouarejx.exe 1860 mouarejx.exe 1860 mouarejx.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE 3468 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3800 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 85 PID 3492 wrote to memory of 3800 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 85 PID 3492 wrote to memory of 3800 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 85 PID 3492 wrote to memory of 2772 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 86 PID 3492 wrote to memory of 2772 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 86 PID 3492 wrote to memory of 2772 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 86 PID 3492 wrote to memory of 2184 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 87 PID 3492 wrote to memory of 2184 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 87 PID 3492 wrote to memory of 2184 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 87 PID 3492 wrote to memory of 4864 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 88 PID 3492 wrote to memory of 4864 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 88 PID 3492 wrote to memory of 4864 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 88 PID 3800 wrote to memory of 1860 3800 gkakzukczw.exe 89 PID 3800 wrote to memory of 1860 3800 gkakzukczw.exe 89 PID 3800 wrote to memory of 1860 3800 gkakzukczw.exe 89 PID 3492 wrote to memory of 3468 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 90 PID 3492 wrote to memory of 3468 3492 f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe"C:\Users\Admin\AppData\Local\Temp\f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\gkakzukczw.exegkakzukczw.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\mouarejx.exeC:\Windows\system32\mouarejx.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1860
-
-
-
C:\Windows\SysWOW64\riqmbndjsblkcld.exeriqmbndjsblkcld.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2772
-
-
C:\Windows\SysWOW64\mouarejx.exemouarejx.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2184
-
-
C:\Windows\SysWOW64\iwubldzpfwbjk.exeiwubldzpfwbjk.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4864
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3468
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD58309c16c837594caed5ac113e7c5b3ff
SHA134cad0141899c238b1f599c2f4364ca05f9db9b0
SHA2561f34b954dddd2d437e21d00b049f4eccb6504f2fdc0eed1b387708fcb27f2d82
SHA512e47cc44b64159295db4014035dc758afe69cbc3ac76821be114374e024a078e2468c35be42a726cc6ad0a389b89e6471cb08780179ce967b2bf0a58a0b54f195
-
Filesize
255KB
MD595ee7002b79a605f5ad0ea93b1a669c8
SHA15cf16a33e878fe39bbf70236686e10520db5fa81
SHA2568b129d43f5984ca1add5ea5dee081433985ba20ffd2167e7956be72509fe018c
SHA5122ccc99be5e933be6bf88d7c519bc3f6ed27a7e7ce8488471d9b26e4a11e724b16043f81ee3c798053ba5218ab9a307cf0ae8c74e5a69ae58515ea3835963cf5c
-
Filesize
255KB
MD595ee7002b79a605f5ad0ea93b1a669c8
SHA15cf16a33e878fe39bbf70236686e10520db5fa81
SHA2568b129d43f5984ca1add5ea5dee081433985ba20ffd2167e7956be72509fe018c
SHA5122ccc99be5e933be6bf88d7c519bc3f6ed27a7e7ce8488471d9b26e4a11e724b16043f81ee3c798053ba5218ab9a307cf0ae8c74e5a69ae58515ea3835963cf5c
-
Filesize
255KB
MD54edb97e4e8de1d179346e2b52103167b
SHA12b63a2fa80abe1be01e8b3293e2ee0ad0e8d678d
SHA256ba5a674416f88e7974d8f81ce6566812fb711ef5baacc366f935bca45f27fd60
SHA512091f025286572af2501a250f2510f5a3c71a8982a19d6a78f7b5e88584e9aa8c6a5d28d8e1b4be32aa97b8913abf2eaf4380262e6d428aff10117f73aab2c508
-
Filesize
255KB
MD578ade9ca05945dde003de3d874f3e333
SHA1e0326e767acba58dc7784950476ef0c1508b2e81
SHA256d8744a975f3f17584463ebe0e2d0f1af7528dffb0f1378791237455331160fc9
SHA512fc765fc05b862ebbbee7a0036c005d4a7e704acc7ad7a33d6d9d11bfbcc6807a30532a89e3d61eb9be882a93af293f7d70d89589ee4101b6fc153701cfb74d81
-
Filesize
255KB
MD578ade9ca05945dde003de3d874f3e333
SHA1e0326e767acba58dc7784950476ef0c1508b2e81
SHA256d8744a975f3f17584463ebe0e2d0f1af7528dffb0f1378791237455331160fc9
SHA512fc765fc05b862ebbbee7a0036c005d4a7e704acc7ad7a33d6d9d11bfbcc6807a30532a89e3d61eb9be882a93af293f7d70d89589ee4101b6fc153701cfb74d81
-
Filesize
255KB
MD5ddbefe1d793f854ab6f5721fe5a1005a
SHA1ca1a91d062f1a3b7f2498225a12fba82c10a8e98
SHA25608c1aa208819a0a25a60bd08a72464814ac100df5807d7e831f19c11291bbb76
SHA512e875acc87f877dfea8f1d214981cb33de8857f58fac852e8e447c7b6e9193188746bddc2f78e7be60848af794fa015a0d975801506a8188e28ea0880b7f21bd6
-
Filesize
255KB
MD5ddbefe1d793f854ab6f5721fe5a1005a
SHA1ca1a91d062f1a3b7f2498225a12fba82c10a8e98
SHA25608c1aa208819a0a25a60bd08a72464814ac100df5807d7e831f19c11291bbb76
SHA512e875acc87f877dfea8f1d214981cb33de8857f58fac852e8e447c7b6e9193188746bddc2f78e7be60848af794fa015a0d975801506a8188e28ea0880b7f21bd6
-
Filesize
255KB
MD5cfb7c8396184ae20059b2beabf0d271b
SHA1da50e20ff38550096844198da14375dcb578666c
SHA2560cb2789107a4157fc4b120825090cfa568ef0ca0617b73719586b481a672b316
SHA512c55f150b1519300b1b073d013f7e7eff0121b9033996e3815efc7193e084d855102bb4f84fe816b1207b7262b34160a0a2bf54ec66610c62ec32f56cbb6e7aad
-
Filesize
255KB
MD5cfb7c8396184ae20059b2beabf0d271b
SHA1da50e20ff38550096844198da14375dcb578666c
SHA2560cb2789107a4157fc4b120825090cfa568ef0ca0617b73719586b481a672b316
SHA512c55f150b1519300b1b073d013f7e7eff0121b9033996e3815efc7193e084d855102bb4f84fe816b1207b7262b34160a0a2bf54ec66610c62ec32f56cbb6e7aad
-
Filesize
255KB
MD5cfb7c8396184ae20059b2beabf0d271b
SHA1da50e20ff38550096844198da14375dcb578666c
SHA2560cb2789107a4157fc4b120825090cfa568ef0ca0617b73719586b481a672b316
SHA512c55f150b1519300b1b073d013f7e7eff0121b9033996e3815efc7193e084d855102bb4f84fe816b1207b7262b34160a0a2bf54ec66610c62ec32f56cbb6e7aad
-
Filesize
255KB
MD57d45817319492382d2b1ce29d72637e9
SHA1362f22d139a642effa58715f31b1acb9ce53c1bd
SHA25664d6e71c85eb9fb88de9e3c60be5ee60d87ccc76d83efbcadb002933678911dd
SHA512d36887a77039bb3588666da5c09ea0678f4967d0b205712dd8fc0a5c710da9d703e528d2bef5d31be04270ba66f4ac55aedf0e26102c95a6a453daf224af3726
-
Filesize
255KB
MD57d45817319492382d2b1ce29d72637e9
SHA1362f22d139a642effa58715f31b1acb9ce53c1bd
SHA25664d6e71c85eb9fb88de9e3c60be5ee60d87ccc76d83efbcadb002933678911dd
SHA512d36887a77039bb3588666da5c09ea0678f4967d0b205712dd8fc0a5c710da9d703e528d2bef5d31be04270ba66f4ac55aedf0e26102c95a6a453daf224af3726
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD50371751d30661b8f5010161e0d4d7e9d
SHA13339ea0eafbf0c3d50e644266659a853949fb41c
SHA25690394b1026a0b95dee57da4df37559d472f8391a79b5973fea544b1b7857bf95
SHA5121bdfed80832fca5edf6c4a41c0d173547f56bd479af24e4cdc9a66e49df2fd954457676ccbc036dbe12af97b1866857614493ceee0a874fa6561d6839b60e45a
-
Filesize
255KB
MD50371751d30661b8f5010161e0d4d7e9d
SHA13339ea0eafbf0c3d50e644266659a853949fb41c
SHA25690394b1026a0b95dee57da4df37559d472f8391a79b5973fea544b1b7857bf95
SHA5121bdfed80832fca5edf6c4a41c0d173547f56bd479af24e4cdc9a66e49df2fd954457676ccbc036dbe12af97b1866857614493ceee0a874fa6561d6839b60e45a
-
Filesize
255KB
MD5d674028d9cd90be2c1b384cd4b1c0b15
SHA1838e3dc0656bbd79ed0606d8e2a54461e4f82599
SHA256fead36d3f7d13999e38e2b91e49b98672e52989ec50302030eebb798851c798f
SHA512a0fb457f55cdf2532ab4a29d9a1d2e2039c39cdca10da21a187f6e70222fef4965a2e5300c40440b872057b7e836d760f7daa58a832af32d67b1ffa44334e19d
-
Filesize
255KB
MD588f62b32a90c4a572d2749105167e2b7
SHA1f795ce0d59b32ea0a1cff22ed9e747117476b458
SHA256c5e309d1a8e36aaf27a4a5423b422b1faf3ccdd5a7e3a24da84aa32a7ae44c37
SHA5127ec90a9a07233127a847dad5220cbfb9822b7280e26b3cde14439d20cd232cebef776b542228c63e02fcaa341ba4c98c1d4acfb21dfd2ff23875380ba4434124