Analysis
- max time kernel
160s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2022, 16:39
Behavioral task
behavioral1
Sample
438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe
Resource
win7-20221111-en
windows7-x64
26 signatures
150 seconds
General
- Target 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe
- Size 255KB
- Sample221127-t52skacb64
- SHA256 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2
- MD5 58ed188bab1917c868bcbe550899e403
- SHA1 3e3ff4a1643fed988f68046e3e6294b52c52737a
- SHA512 7aa3159cf3429f6446b62fc07ea281c0f9697e17aab2a3b56e341a88072daaca855b09c8280503a651c452fdf64dc74cf392e7602e2d1bebb6b93866e0505748
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ6:1xlZam+akqx6YQJXcNlEHUIQeE3mmBID
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ulqiymmano.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ulqiymmano.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ulqiymmano.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ulqiymmano.exe - Executes dropped EXE 5 IoCs
pid Process 1732 ulqiymmano.exe 4964 lhhkmweraeanpnm.exe 3388 vlxqqmkf.exe 4856 gnxndylghggqn.exe 1516 vlxqqmkf.exe -
resource yara_rule behavioral2/memory/3068-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000f000000022f5f-134.dat upx behavioral2/files/0x000f000000022f5f-135.dat upx behavioral2/files/0x0008000000022f63-137.dat upx behavioral2/files/0x0008000000022f63-138.dat upx behavioral2/files/0x0006000000022f69-140.dat upx behavioral2/files/0x0006000000022f69-142.dat upx behavioral2/files/0x0006000000022f6a-144.dat upx behavioral2/files/0x0006000000022f6a-143.dat upx behavioral2/memory/3068-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1732-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4964-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3388-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4856-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0006000000022f69-151.dat upx behavioral2/memory/1516-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3068-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1732-155-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4964-156-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3388-157-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4856-158-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000022f70-159.dat upx behavioral2/files/0x0006000000022f71-160.dat upx behavioral2/memory/1516-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000200000001e2c1-170.dat upx behavioral2/files/0x0003000000000723-171.dat upx behavioral2/files/0x0003000000000723-178.dat upx behavioral2/files/0x0003000000000723-177.dat upx - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ulqiymmano.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run lhhkmweraeanpnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahjhwljs = "ulqiymmano.exe" lhhkmweraeanpnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kyxneskh = "lhhkmweraeanpnm.exe" lhhkmweraeanpnm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "gnxndylghggqn.exe" lhhkmweraeanpnm.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: vlxqqmkf.exe File opened (read-only) \??\i: vlxqqmkf.exe File opened (read-only) \??\q: vlxqqmkf.exe File opened (read-only) \??\s: vlxqqmkf.exe File opened (read-only) \??\l: ulqiymmano.exe File opened (read-only) \??\u: vlxqqmkf.exe File opened (read-only) \??\a: vlxqqmkf.exe File opened (read-only) \??\h: vlxqqmkf.exe File opened (read-only) \??\k: vlxqqmkf.exe File opened (read-only) \??\v: vlxqqmkf.exe File opened (read-only) \??\y: ulqiymmano.exe File opened (read-only) \??\o: vlxqqmkf.exe File opened (read-only) \??\r: vlxqqmkf.exe File opened (read-only) \??\b: vlxqqmkf.exe File opened (read-only) \??\m: ulqiymmano.exe File opened (read-only) \??\p: ulqiymmano.exe File opened (read-only) \??\i: vlxqqmkf.exe File opened (read-only) \??\m: vlxqqmkf.exe File opened (read-only) \??\p: vlxqqmkf.exe File opened (read-only) \??\r: ulqiymmano.exe File opened (read-only) \??\f: vlxqqmkf.exe File opened (read-only) \??\k: vlxqqmkf.exe File opened (read-only) \??\y: vlxqqmkf.exe File opened (read-only) \??\e: vlxqqmkf.exe File opened (read-only) \??\u: vlxqqmkf.exe File opened (read-only) \??\y: vlxqqmkf.exe File opened (read-only) \??\m: vlxqqmkf.exe File opened (read-only) \??\t: vlxqqmkf.exe File opened (read-only) \??\x: vlxqqmkf.exe File opened (read-only) \??\i: ulqiymmano.exe File opened (read-only) \??\l: vlxqqmkf.exe File opened (read-only) \??\q: vlxqqmkf.exe File opened (read-only) \??\v: vlxqqmkf.exe File opened (read-only) \??\o: ulqiymmano.exe File opened (read-only) \??\x: ulqiymmano.exe File opened (read-only) \??\g: vlxqqmkf.exe File opened (read-only) \??\r: vlxqqmkf.exe File opened (read-only) \??\b: ulqiymmano.exe File opened (read-only) \??\g: ulqiymmano.exe File opened (read-only) \??\h: ulqiymmano.exe File opened (read-only) \??\v: ulqiymmano.exe File opened (read-only) \??\a: vlxqqmkf.exe File opened (read-only) \??\h: vlxqqmkf.exe File opened (read-only) \??\x: vlxqqmkf.exe File opened (read-only) \??\f: vlxqqmkf.exe File opened (read-only) \??\l: vlxqqmkf.exe File opened (read-only) \??\w: vlxqqmkf.exe File opened (read-only) \??\f: ulqiymmano.exe File opened (read-only) \??\e: vlxqqmkf.exe File opened (read-only) \??\p: vlxqqmkf.exe File opened (read-only) \??\t: vlxqqmkf.exe File opened (read-only) \??\n: vlxqqmkf.exe File opened (read-only) \??\w: ulqiymmano.exe File opened (read-only) \??\n: vlxqqmkf.exe File opened (read-only) \??\z: vlxqqmkf.exe File opened (read-only) \??\a: ulqiymmano.exe File opened (read-only) \??\t: ulqiymmano.exe File opened (read-only) \??\w: vlxqqmkf.exe File opened (read-only) \??\j: vlxqqmkf.exe File opened (read-only) \??\e: ulqiymmano.exe File opened (read-only) \??\s: ulqiymmano.exe File opened (read-only) \??\s: vlxqqmkf.exe File opened (read-only) \??\j: ulqiymmano.exe File opened (read-only) \??\n: ulqiymmano.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ulqiymmano.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ulqiymmano.exe - AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3068-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1732-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4964-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3388-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4856-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1516-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3068-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1732-155-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4964-156-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3388-157-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4856-158-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1516-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\vlxqqmkf.exe 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe File created C:\Windows\SysWOW64\gnxndylghggqn.exe 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe vlxqqmkf.exe File created C:\Windows\SysWOW64\ulqiymmano.exe 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe File created C:\Windows\SysWOW64\vlxqqmkf.exe 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe File opened for modification C:\Windows\SysWOW64\lhhkmweraeanpnm.exe 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe File opened for modification C:\Windows\SysWOW64\gnxndylghggqn.exe 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ulqiymmano.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe vlxqqmkf.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe vlxqqmkf.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe vlxqqmkf.exe File opened for modification C:\Windows\SysWOW64\ulqiymmano.exe 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe File created C:\Windows\SysWOW64\lhhkmweraeanpnm.exe 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vlxqqmkf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal vlxqqmkf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal vlxqqmkf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vlxqqmkf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal vlxqqmkf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vlxqqmkf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vlxqqmkf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vlxqqmkf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vlxqqmkf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vlxqqmkf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vlxqqmkf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vlxqqmkf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal vlxqqmkf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vlxqqmkf.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ulqiymmano.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ulqiymmano.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ulqiymmano.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ulqiymmano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ulqiymmano.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ulqiymmano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB9FABCF965F192837D3A46869E3E93B08E02F14369034EE2CE42EE08A7" 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F06BC4FE6E21D0D10ED0A28A089010" 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B15F44E638E352CFBAA6329ED7B9" 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32462C0F9D5783566D3576DD70542CDF7D8064D6" 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFF894F28851F913CD62E7DE0BD95E14359406740623FD79A" 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC7781493DAB5B8C17FE7ED9534BA" 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ulqiymmano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ulqiymmano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ulqiymmano.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ulqiymmano.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ulqiymmano.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ulqiymmano.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2884 WINWORD.EXE 2884 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 3388 vlxqqmkf.exe 3388 vlxqqmkf.exe 4856 gnxndylghggqn.exe 3388 vlxqqmkf.exe 3388 vlxqqmkf.exe 4856 gnxndylghggqn.exe 3388 vlxqqmkf.exe 4856 gnxndylghggqn.exe 3388 vlxqqmkf.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 3388 vlxqqmkf.exe 4856 gnxndylghggqn.exe 3388 vlxqqmkf.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 3388 vlxqqmkf.exe 3388 vlxqqmkf.exe 3388 vlxqqmkf.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 1516 vlxqqmkf.exe 1516 vlxqqmkf.exe 1516 vlxqqmkf.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 1732 ulqiymmano.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 4964 lhhkmweraeanpnm.exe 3388 vlxqqmkf.exe 3388 vlxqqmkf.exe 3388 vlxqqmkf.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 4856 gnxndylghggqn.exe 1516 vlxqqmkf.exe 1516 vlxqqmkf.exe 1516 vlxqqmkf.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2884 WINWORD.EXE 2884 WINWORD.EXE 2884 WINWORD.EXE 2884 WINWORD.EXE 2884 WINWORD.EXE 2884 WINWORD.EXE 2884 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1732 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 78 PID 3068 wrote to memory of 1732 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 78 PID 3068 wrote to memory of 1732 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 78 PID 3068 wrote to memory of 4964 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 79 PID 3068 wrote to memory of 4964 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 79 PID 3068 wrote to memory of 4964 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 79 PID 3068 wrote to memory of 3388 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 81 PID 3068 wrote to memory of 3388 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 81 PID 3068 wrote to memory of 3388 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 81 PID 3068 wrote to memory of 4856 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 80 PID 3068 wrote to memory of 4856 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 80 PID 3068 wrote to memory of 4856 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 80 PID 1732 wrote to memory of 1516 1732 ulqiymmano.exe 82 PID 1732 wrote to memory of 1516 1732 ulqiymmano.exe 82 PID 1732 wrote to memory of 1516 1732 ulqiymmano.exe 82 PID 3068 wrote to memory of 2884 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 83 PID 3068 wrote to memory of 2884 3068 438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe"C:\Users\Admin\AppData\Local\Temp\438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\ulqiymmano.exeulqiymmano.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\vlxqqmkf.exeC:\Windows\system32\vlxqqmkf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1516
-
-
-
C:\Windows\SysWOW64\lhhkmweraeanpnm.exelhhkmweraeanpnm.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4964
-
-
C:\Windows\SysWOW64\gnxndylghggqn.exegnxndylghggqn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4856
-
-
C:\Windows\SysWOW64\vlxqqmkf.exevlxqqmkf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3388
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2884
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 255KB
- SHA256 c7337e21f3ac63dcfd0e04b1fda126d75cc1b9b48f889fb681e4041869d608e3
- MD5 b49357846413e22c221e100875e6e9b6
- SHA1 64189652d6874556262c17f4df979eba411d07cd
- SHA512 78414e3f2ea6421503e63518da4c3022373e82ffec0c975cf65ccca34e451af672c276863f76f775ebfcc83b8ebed3227f6f532a92b80ff2e7be9e5a318298b1
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJA:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 255KB
- SHA256 a8bb3e29925327f388a9ff0dcca2ca2d546652bf7b752a949534ecd3c9a4f4bb
- MD5 a6c469bedea34b8147c77759f0b98563
- SHA1 346600fd62fd25da623caca7788b3f232d8952c4
- SHA512 9752ad2bd13c7c241e8b0d86d6275f7ec7d67fc1f9df482704f6e7f1cf39cce6a52444d3df3fbb338d9846ea1911690c4604755a02b34e8e456bcb48f19f2a19
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJh:1xlZam+akqx6YQJXcNlEHUIQeE3mmBII
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\Documents\BackupConvert.doc.exe
- Size 255KB
- SHA256 88e39c5169e2d7910a87f238c6668c7cd8e16b23e0c2c4065ab78814411b6c62
- MD5 ba3ef8ab23db32503e46f20310934038
- SHA1 cc2f0285afcee222e7464a4d93f8c55731b2e228
- SHA512 9f6392f8cf583f095d9d2a1a4d1d119c5c59cfc3018bc6b1e0665d04b9ec452f76f0ddbb78f2a3a9b80dd651cb56058fd5c12fb6379334e61b2716ec1f4b43e9
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJn:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\gnxndylghggqn.exe
- Size 255KB
- SHA256 a84e37c2feca2662ead4e7101b09e4ebe81bea29127a1ad7eb430f842309eb71
- MD5 279225dd65105643dff3d70d24f0ef41
- SHA1 d57cef538db6cb2fd8b2b51ea9206d12a8e3b3e1
- SHA512 e87d31c0141c25c43c04e2c181df20d00cbeafa2d7af5c56e53b8614dbc3d8360911d47fc0ceac2625dbf1c4a4f93306bb5bf026a56bfb21ec79805f8c92ce0d
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJm:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\gnxndylghggqn.exe
- Size 255KB
- SHA256 a84e37c2feca2662ead4e7101b09e4ebe81bea29127a1ad7eb430f842309eb71
- MD5 279225dd65105643dff3d70d24f0ef41
- SHA1 d57cef538db6cb2fd8b2b51ea9206d12a8e3b3e1
- SHA512 e87d31c0141c25c43c04e2c181df20d00cbeafa2d7af5c56e53b8614dbc3d8360911d47fc0ceac2625dbf1c4a4f93306bb5bf026a56bfb21ec79805f8c92ce0d
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJm:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\lhhkmweraeanpnm.exe
- Size 255KB
- SHA256 447bfd9e42b751657d7f223c733cb646ec393cadebdc278e0b06855ce90f209c
- MD5 10bccb671dfb8fb665625ee360d23450
- SHA1 f17d89311cec7c7c41e785bba5e09811b35300c8
- SHA512 1cdcd89b39489ebcc9a3d6538523f2c276984fc4aa5baef74364522f86fb2f7f5ed313377d0c07125c141032f6a61c907eee4fead7045b5082e2829d5350d1a7
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJE:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\lhhkmweraeanpnm.exe
- Size 255KB
- SHA256 447bfd9e42b751657d7f223c733cb646ec393cadebdc278e0b06855ce90f209c
- MD5 10bccb671dfb8fb665625ee360d23450
- SHA1 f17d89311cec7c7c41e785bba5e09811b35300c8
- SHA512 1cdcd89b39489ebcc9a3d6538523f2c276984fc4aa5baef74364522f86fb2f7f5ed313377d0c07125c141032f6a61c907eee4fead7045b5082e2829d5350d1a7
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJE:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ulqiymmano.exe
- Size 255KB
- SHA256 bae70b84c8a5e560554f590ff1a500ec61daf9b7553138c696cf24622d078dc5
- MD5 2dfd2e3b9afa21d8f9a3590650044aed
- SHA1 24f2c6be609738f228162db158cb374858d61cfb
- SHA512 c517ff37167d766b199432bd7ad3d3001b6ddbf09eb5744a38c19f94a056c6bb2f963f5b60e55bed29d10b5e43ecb5ccac0fc47deef8ed670239121a4c7b0795
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJR:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ulqiymmano.exe
- Size 255KB
- SHA256 bae70b84c8a5e560554f590ff1a500ec61daf9b7553138c696cf24622d078dc5
- MD5 2dfd2e3b9afa21d8f9a3590650044aed
- SHA1 24f2c6be609738f228162db158cb374858d61cfb
- SHA512 c517ff37167d766b199432bd7ad3d3001b6ddbf09eb5744a38c19f94a056c6bb2f963f5b60e55bed29d10b5e43ecb5ccac0fc47deef8ed670239121a4c7b0795
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJR:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\vlxqqmkf.exe
- Size 255KB
- SHA256 520a547bf262556ef4e0602f462c5db6f46f1c4cd2b3a0db702a7aae0239d940
- MD5 46bc1f7de0934edda2d0390e366d1379
- SHA1 3394febf8b3e821668308ef6fc26aea8abe47710
- SHA512 d89fbe283931dabfd3614b59f8991c74745988849ba168dc4b56867b78f76b13ae4eac0f5ec3cabd756385c11a6d8f96fa0dc0ff45b4d4a49fd85a4c08071b48
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\vlxqqmkf.exe
- Size 255KB
- SHA256 520a547bf262556ef4e0602f462c5db6f46f1c4cd2b3a0db702a7aae0239d940
- MD5 46bc1f7de0934edda2d0390e366d1379
- SHA1 3394febf8b3e821668308ef6fc26aea8abe47710
- SHA512 d89fbe283931dabfd3614b59f8991c74745988849ba168dc4b56867b78f76b13ae4eac0f5ec3cabd756385c11a6d8f96fa0dc0ff45b4d4a49fd85a4c08071b48
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\vlxqqmkf.exe
- Size 255KB
- SHA256 520a547bf262556ef4e0602f462c5db6f46f1c4cd2b3a0db702a7aae0239d940
- MD5 46bc1f7de0934edda2d0390e366d1379
- SHA1 3394febf8b3e821668308ef6fc26aea8abe47710
- SHA512 d89fbe283931dabfd3614b59f8991c74745988849ba168dc4b56867b78f76b13ae4eac0f5ec3cabd756385c11a6d8f96fa0dc0ff45b4d4a49fd85a4c08071b48
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 ca9fe174808896349863d9e33dd8afe841cb1e5cb1733cc39d06dbe83ce55a1d
- MD5 cce6f4d4409121b72d9595b74c528680
- SHA1 974bcee30b5bb0d2565c3fbef98cb080f45d594b
- SHA512 c493ae31c62768c7b5d6f6449f300fe2cf0e521e5a6d73eba0300b0f96b6295b89a99c9048f8efcfcb83d1769ca0d59be5b0a6a297907074bccf31131e395b0a
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJb:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIC
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 fb153852cf58d32dba953fed087933fd343241d152ad9b5795219e6a982cb826
- MD5 5d2cd9cc67fb5c9b8477a58a8baf9f5c
- SHA1 0375ea9671156c4a18c624fc297d3a611553cd37
- SHA512 b9aff2fe6322afa09d3478626f3ab07b0c5b33d98b2d7e15d1222083cd26fa73cce03bae03df8d63f328e4dc17db68d68d91c6aa12ef25f808ea60724595ddcd
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJx:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIA
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 fb153852cf58d32dba953fed087933fd343241d152ad9b5795219e6a982cb826
- MD5 5d2cd9cc67fb5c9b8477a58a8baf9f5c
- SHA1 0375ea9671156c4a18c624fc297d3a611553cd37
- SHA512 b9aff2fe6322afa09d3478626f3ab07b0c5b33d98b2d7e15d1222083cd26fa73cce03bae03df8d63f328e4dc17db68d68d91c6aa12ef25f808ea60724595ddcd
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJx:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIA
- MD5 SHA1 SHA512 SSDEEP