Analysis
-
max time kernel
210s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 16:38
Behavioral task
behavioral1
Sample
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe
Resource
win10v2004-20221111-en
General
-
Target
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe
-
Size
255KB
-
MD5
445ebea2dac416aaec5cc891c9bdd5e0
-
SHA1
8741e82486f5e5d1216f5e8d654d97e489f894a2
-
SHA256
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5
-
SHA512
250f9c800c57de35e524e8dfa9d2dfeeb15f48f61ca6bed3875489b9c66228dc78b4f886fe2231da6cbaba0eeed8a74f18b90903f85d9984b5a2a38da24e1fb8
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJj:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIq
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
pyohjxcint.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" pyohjxcint.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
pyohjxcint.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pyohjxcint.exe -
Processes:
pyohjxcint.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" pyohjxcint.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
pyohjxcint.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" pyohjxcint.exe -
Executes dropped EXE 5 IoCs
Processes:
pyohjxcint.exekpuvqrhaulpjfne.exeeqpwmmmc.exeatyyblijfwyoa.exeeqpwmmmc.exepid process 224 pyohjxcint.exe 2764 kpuvqrhaulpjfne.exe 4584 eqpwmmmc.exe 4276 atyyblijfwyoa.exe 3060 eqpwmmmc.exe -
Processes:
resource yara_rule behavioral2/memory/4640-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\pyohjxcint.exe upx C:\Windows\SysWOW64\pyohjxcint.exe upx C:\Windows\SysWOW64\kpuvqrhaulpjfne.exe upx C:\Windows\SysWOW64\eqpwmmmc.exe upx C:\Windows\SysWOW64\atyyblijfwyoa.exe upx C:\Windows\SysWOW64\atyyblijfwyoa.exe upx C:\Windows\SysWOW64\eqpwmmmc.exe upx C:\Windows\SysWOW64\kpuvqrhaulpjfne.exe upx behavioral2/memory/224-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2764-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4276-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4584-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\eqpwmmmc.exe upx behavioral2/memory/3060-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4640-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/224-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2764-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4584-155-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4276-156-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3060-157-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4640-159-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe upx \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe -
Processes:
pyohjxcint.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" pyohjxcint.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
kpuvqrhaulpjfne.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\anrrhqkb = "pyohjxcint.exe" kpuvqrhaulpjfne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tpxbtvsp = "kpuvqrhaulpjfne.exe" kpuvqrhaulpjfne.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "atyyblijfwyoa.exe" kpuvqrhaulpjfne.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kpuvqrhaulpjfne.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
eqpwmmmc.exepyohjxcint.exeeqpwmmmc.exedescription ioc process File opened (read-only) \??\a: eqpwmmmc.exe File opened (read-only) \??\b: eqpwmmmc.exe File opened (read-only) \??\p: eqpwmmmc.exe File opened (read-only) \??\s: eqpwmmmc.exe File opened (read-only) \??\u: eqpwmmmc.exe File opened (read-only) \??\k: pyohjxcint.exe File opened (read-only) \??\o: eqpwmmmc.exe File opened (read-only) \??\j: eqpwmmmc.exe File opened (read-only) \??\t: eqpwmmmc.exe File opened (read-only) \??\u: pyohjxcint.exe File opened (read-only) \??\r: eqpwmmmc.exe File opened (read-only) \??\u: eqpwmmmc.exe File opened (read-only) \??\o: pyohjxcint.exe File opened (read-only) \??\q: pyohjxcint.exe File opened (read-only) \??\m: eqpwmmmc.exe File opened (read-only) \??\t: pyohjxcint.exe File opened (read-only) \??\i: eqpwmmmc.exe File opened (read-only) \??\z: eqpwmmmc.exe File opened (read-only) \??\g: pyohjxcint.exe File opened (read-only) \??\m: pyohjxcint.exe File opened (read-only) \??\o: eqpwmmmc.exe File opened (read-only) \??\b: eqpwmmmc.exe File opened (read-only) \??\n: eqpwmmmc.exe File opened (read-only) \??\p: eqpwmmmc.exe File opened (read-only) \??\i: pyohjxcint.exe File opened (read-only) \??\g: eqpwmmmc.exe File opened (read-only) \??\x: eqpwmmmc.exe File opened (read-only) \??\f: eqpwmmmc.exe File opened (read-only) \??\n: pyohjxcint.exe File opened (read-only) \??\r: pyohjxcint.exe File opened (read-only) \??\w: eqpwmmmc.exe File opened (read-only) \??\t: eqpwmmmc.exe File opened (read-only) \??\x: pyohjxcint.exe File opened (read-only) \??\n: eqpwmmmc.exe File opened (read-only) \??\q: eqpwmmmc.exe File opened (read-only) \??\g: eqpwmmmc.exe File opened (read-only) \??\v: pyohjxcint.exe File opened (read-only) \??\e: eqpwmmmc.exe File opened (read-only) \??\i: eqpwmmmc.exe File opened (read-only) \??\k: eqpwmmmc.exe File opened (read-only) \??\a: eqpwmmmc.exe File opened (read-only) \??\a: pyohjxcint.exe File opened (read-only) \??\e: pyohjxcint.exe File opened (read-only) \??\z: eqpwmmmc.exe File opened (read-only) \??\h: eqpwmmmc.exe File opened (read-only) \??\l: eqpwmmmc.exe File opened (read-only) \??\s: eqpwmmmc.exe File opened (read-only) \??\v: eqpwmmmc.exe File opened (read-only) \??\y: eqpwmmmc.exe File opened (read-only) \??\s: pyohjxcint.exe File opened (read-only) \??\y: pyohjxcint.exe File opened (read-only) \??\y: eqpwmmmc.exe File opened (read-only) \??\e: eqpwmmmc.exe File opened (read-only) \??\l: pyohjxcint.exe File opened (read-only) \??\m: eqpwmmmc.exe File opened (read-only) \??\q: eqpwmmmc.exe File opened (read-only) \??\b: pyohjxcint.exe File opened (read-only) \??\f: pyohjxcint.exe File opened (read-only) \??\p: pyohjxcint.exe File opened (read-only) \??\f: eqpwmmmc.exe File opened (read-only) \??\l: eqpwmmmc.exe File opened (read-only) \??\x: eqpwmmmc.exe File opened (read-only) \??\k: eqpwmmmc.exe File opened (read-only) \??\w: pyohjxcint.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
pyohjxcint.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" pyohjxcint.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" pyohjxcint.exe -
AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4640-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/224-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2764-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4276-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4584-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3060-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4640-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/224-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2764-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4584-155-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4276-156-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3060-157-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4640-159-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exepyohjxcint.exedescription ioc process File opened for modification C:\Windows\SysWOW64\eqpwmmmc.exe 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe File created C:\Windows\SysWOW64\atyyblijfwyoa.exe 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe File opened for modification C:\Windows\SysWOW64\atyyblijfwyoa.exe 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll pyohjxcint.exe File created C:\Windows\SysWOW64\eqpwmmmc.exe 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe File opened for modification C:\Windows\SysWOW64\pyohjxcint.exe 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe File created C:\Windows\SysWOW64\kpuvqrhaulpjfne.exe 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe File opened for modification C:\Windows\SysWOW64\kpuvqrhaulpjfne.exe 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe File created C:\Windows\SysWOW64\pyohjxcint.exe 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe -
Drops file in Program Files directory 15 IoCs
Processes:
eqpwmmmc.exeeqpwmmmc.exedescription ioc process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eqpwmmmc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal eqpwmmmc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal eqpwmmmc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal eqpwmmmc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eqpwmmmc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal eqpwmmmc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eqpwmmmc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eqpwmmmc.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eqpwmmmc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eqpwmmmc.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eqpwmmmc.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eqpwmmmc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe eqpwmmmc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eqpwmmmc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe eqpwmmmc.exe -
Drops file in Windows directory 3 IoCs
Processes:
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exepyohjxcint.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1944C70E1493DAC0B9C07FE2ECE437C9" 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh pyohjxcint.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf pyohjxcint.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" pyohjxcint.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB7B02B44EE389E53BABAA63298D7C5" 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E89FC834F2982189141D72B7D9CBDE7E1345840664E6331D7EC" 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F06BC2FF6622DAD278D1D68A0B9113" 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" pyohjxcint.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc pyohjxcint.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" pyohjxcint.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat pyohjxcint.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" pyohjxcint.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs pyohjxcint.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" pyohjxcint.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32432D089C2683576A3677A770252CD77D8065DD" 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABEF9CBFE13F2E4840E3A4386EC3990B38A02F842680333E1C842EE08D6" 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" pyohjxcint.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg pyohjxcint.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 5000 WINWORD.EXE 5000 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exepyohjxcint.exekpuvqrhaulpjfne.exeeqpwmmmc.exeatyyblijfwyoa.exeeqpwmmmc.exepid process 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exepyohjxcint.exekpuvqrhaulpjfne.exeeqpwmmmc.exeatyyblijfwyoa.exeeqpwmmmc.exepid process 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exepyohjxcint.exekpuvqrhaulpjfne.exeeqpwmmmc.exeatyyblijfwyoa.exeeqpwmmmc.exepid process 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 224 pyohjxcint.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 2764 kpuvqrhaulpjfne.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4584 eqpwmmmc.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 4276 atyyblijfwyoa.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe 3060 eqpwmmmc.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 5000 WINWORD.EXE 5000 WINWORD.EXE 5000 WINWORD.EXE 5000 WINWORD.EXE 5000 WINWORD.EXE 5000 WINWORD.EXE 5000 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exepyohjxcint.exedescription pid process target process PID 4640 wrote to memory of 224 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe pyohjxcint.exe PID 4640 wrote to memory of 224 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe pyohjxcint.exe PID 4640 wrote to memory of 224 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe pyohjxcint.exe PID 4640 wrote to memory of 2764 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe kpuvqrhaulpjfne.exe PID 4640 wrote to memory of 2764 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe kpuvqrhaulpjfne.exe PID 4640 wrote to memory of 2764 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe kpuvqrhaulpjfne.exe PID 4640 wrote to memory of 4584 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe eqpwmmmc.exe PID 4640 wrote to memory of 4584 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe eqpwmmmc.exe PID 4640 wrote to memory of 4584 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe eqpwmmmc.exe PID 4640 wrote to memory of 4276 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe atyyblijfwyoa.exe PID 4640 wrote to memory of 4276 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe atyyblijfwyoa.exe PID 4640 wrote to memory of 4276 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe atyyblijfwyoa.exe PID 4640 wrote to memory of 5000 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe WINWORD.EXE PID 4640 wrote to memory of 5000 4640 6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe WINWORD.EXE PID 224 wrote to memory of 3060 224 pyohjxcint.exe eqpwmmmc.exe PID 224 wrote to memory of 3060 224 pyohjxcint.exe eqpwmmmc.exe PID 224 wrote to memory of 3060 224 pyohjxcint.exe eqpwmmmc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe"C:\Users\Admin\AppData\Local\Temp\6a667d54547ed2a293aa2b5c45871358ca306c77417247944e48aaccefbc16e5.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\pyohjxcint.exepyohjxcint.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\eqpwmmmc.exeC:\Windows\system32\eqpwmmmc.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\kpuvqrhaulpjfne.exekpuvqrhaulpjfne.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\eqpwmmmc.exeeqpwmmmc.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\atyyblijfwyoa.exeatyyblijfwyoa.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
6Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
255KB
MD5ea53205d2b2a90ea96a7e5e55b9eb949
SHA135bdf60c940549dec37a477746f8552f7089e6cb
SHA2567e97ad58fcc9e6c052c493669e12b21b7938bed07f50709ad08750e2353d178b
SHA5127063a37160cb78a1a7e57a65d294abdd59344495b320702ba35624ea15908f2fb48a62e24c799f0d6db8bef565816d5e2a7a6e1de3c09713931eaf52f4f6b8dc
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD55b41e7913c11289d72daecac0c95fb60
SHA12e748fbfda2a4e1448b7145822a4344bdf8bae63
SHA256d18503463cb6482b667164cd22254b4c95959e0c9930c0c4f54144607c9b10b3
SHA5122df25ef385c9832659d8dc60d668d37b710b7033323bb38fa637c164b817c88436e7c764c0e9ec38d1cb44ef3a8745762c9e3e6eff0ed0653718212deedcdb7e
-
C:\Windows\SysWOW64\atyyblijfwyoa.exeFilesize
255KB
MD51a44fb48c122dc096abfc4e72662cee6
SHA199433c155d1123a4aeacbd4e7cd0c4aff1ec2170
SHA25620e1530eb14431a9737556bfc38a27b3e3cae739a3c7ed7447f95ae9440581c7
SHA51206827571a2d229fac762b813857f6037795f4b7fbf8606464175527df0f237a013245287fac16d218279f5ce4f28d5440f45d81f961f5e5b4c63d116b5dcbe1f
-
C:\Windows\SysWOW64\atyyblijfwyoa.exeFilesize
255KB
MD51a44fb48c122dc096abfc4e72662cee6
SHA199433c155d1123a4aeacbd4e7cd0c4aff1ec2170
SHA25620e1530eb14431a9737556bfc38a27b3e3cae739a3c7ed7447f95ae9440581c7
SHA51206827571a2d229fac762b813857f6037795f4b7fbf8606464175527df0f237a013245287fac16d218279f5ce4f28d5440f45d81f961f5e5b4c63d116b5dcbe1f
-
C:\Windows\SysWOW64\eqpwmmmc.exeFilesize
255KB
MD5c77764de35c80cbb374efb0ee9f234cf
SHA1c0773aaea01ecb29a29f5b9f65cce3e5dac8f691
SHA256b8c99fda6e9af5b29a240fea76fc3b0bfdfd6a3486b833aad6c34bc6dc08bf01
SHA5122b4b27b4be9e4b7ff9069c98640cb580c855c91fc41eef554c13922c01568e81137ca84e07acded3856cc40d1c671c4ae93d96a9d460f5390ed902d659acc455
-
C:\Windows\SysWOW64\eqpwmmmc.exeFilesize
255KB
MD5c77764de35c80cbb374efb0ee9f234cf
SHA1c0773aaea01ecb29a29f5b9f65cce3e5dac8f691
SHA256b8c99fda6e9af5b29a240fea76fc3b0bfdfd6a3486b833aad6c34bc6dc08bf01
SHA5122b4b27b4be9e4b7ff9069c98640cb580c855c91fc41eef554c13922c01568e81137ca84e07acded3856cc40d1c671c4ae93d96a9d460f5390ed902d659acc455
-
C:\Windows\SysWOW64\eqpwmmmc.exeFilesize
255KB
MD5c77764de35c80cbb374efb0ee9f234cf
SHA1c0773aaea01ecb29a29f5b9f65cce3e5dac8f691
SHA256b8c99fda6e9af5b29a240fea76fc3b0bfdfd6a3486b833aad6c34bc6dc08bf01
SHA5122b4b27b4be9e4b7ff9069c98640cb580c855c91fc41eef554c13922c01568e81137ca84e07acded3856cc40d1c671c4ae93d96a9d460f5390ed902d659acc455
-
C:\Windows\SysWOW64\kpuvqrhaulpjfne.exeFilesize
255KB
MD54c55517fa9bf0691e2e0508786755010
SHA124d3062a33f1d207b40059e5f03130f28c27c97d
SHA2567ae9954030ff3d47ff24a8e1bb9379b7c48d8d067a6e506469f6f1414aaf1945
SHA51208218cc34f5e3dcdd804b484c02f893ec198bf7114636fc5e66fc791b2e1654f74852c360aa5653c6383d3430aabd43d81b96cdafa6d7fb1b373525a28b5855b
-
C:\Windows\SysWOW64\kpuvqrhaulpjfne.exeFilesize
255KB
MD54c55517fa9bf0691e2e0508786755010
SHA124d3062a33f1d207b40059e5f03130f28c27c97d
SHA2567ae9954030ff3d47ff24a8e1bb9379b7c48d8d067a6e506469f6f1414aaf1945
SHA51208218cc34f5e3dcdd804b484c02f893ec198bf7114636fc5e66fc791b2e1654f74852c360aa5653c6383d3430aabd43d81b96cdafa6d7fb1b373525a28b5855b
-
C:\Windows\SysWOW64\pyohjxcint.exeFilesize
255KB
MD5d2cb4c60f1540bc4b92427439220f9d7
SHA1642507c3ac289329a0d89ea2420003e8851bf630
SHA256ba1e2496d0293bed95d1dcd2a528b00e3835a9a266d7e1d36397342225d93700
SHA51251a051296bf45e3d98ff088680ab30de70f9a9b8831748eae230c359a7043deee9566ee7eed50bde486d7be3dfa14bbe2bc54ba1b33d199dec6edbea3c5a70cf
-
C:\Windows\SysWOW64\pyohjxcint.exeFilesize
255KB
MD5d2cb4c60f1540bc4b92427439220f9d7
SHA1642507c3ac289329a0d89ea2420003e8851bf630
SHA256ba1e2496d0293bed95d1dcd2a528b00e3835a9a266d7e1d36397342225d93700
SHA51251a051296bf45e3d98ff088680ab30de70f9a9b8831748eae230c359a7043deee9566ee7eed50bde486d7be3dfa14bbe2bc54ba1b33d199dec6edbea3c5a70cf
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
255KB
MD5ea53205d2b2a90ea96a7e5e55b9eb949
SHA135bdf60c940549dec37a477746f8552f7089e6cb
SHA2567e97ad58fcc9e6c052c493669e12b21b7938bed07f50709ad08750e2353d178b
SHA5127063a37160cb78a1a7e57a65d294abdd59344495b320702ba35624ea15908f2fb48a62e24c799f0d6db8bef565816d5e2a7a6e1de3c09713931eaf52f4f6b8dc
-
memory/224-145-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/224-133-0x0000000000000000-mapping.dmp
-
memory/224-153-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2764-136-0x0000000000000000-mapping.dmp
-
memory/2764-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2764-154-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3060-151-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3060-157-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3060-149-0x0000000000000000-mapping.dmp
-
memory/4276-148-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4276-142-0x0000000000000000-mapping.dmp
-
memory/4276-156-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4584-155-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4584-139-0x0000000000000000-mapping.dmp
-
memory/4584-147-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4640-152-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4640-159-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4640-132-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/5000-161-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/5000-164-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/5000-163-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/5000-162-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB
-
memory/5000-158-0x0000000000000000-mapping.dmp
-
memory/5000-168-0x00007FF9D24F0000-0x00007FF9D2500000-memory.dmpFilesize
64KB
-
memory/5000-169-0x00007FF9D24F0000-0x00007FF9D2500000-memory.dmpFilesize
64KB
-
memory/5000-160-0x00007FF9D4C70000-0x00007FF9D4C80000-memory.dmpFilesize
64KB