Analysis
-
max time kernel
286s -
max time network
342s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 16:43
Behavioral task
behavioral1
Sample
47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe
Resource
win7-20220812-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe
-
Size
255KB
-
MD5
6e68d380cc479a04cfd4574f9c3bcb9e
-
SHA1
926985370b9cba4c617ddc17c6d2b57c23dcefd5
-
SHA256
47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe
-
SHA512
54750c1a82924674e3fb708831f4e457c0294f6fc161e8da2cc6a1c8d3814402228e21c3beefc4b83751079cedc5b7beee183aea4206dceeee1732c6e1e14b6d
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJd:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIk
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ynudqtiyza.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ynudqtiyza.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ynudqtiyza.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ynudqtiyza.exe -
Executes dropped EXE 5 IoCs
pid Process 3076 ynudqtiyza.exe 1884 hxbwwjhedohzyaq.exe 628 fkwkvpbr.exe 3248 zybvdzjpwdrir.exe 4436 fkwkvpbr.exe -
resource yara_rule behavioral2/memory/5064-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0009000000022db5-134.dat upx behavioral2/files/0x0009000000022db5-135.dat upx behavioral2/files/0x0007000000022dbc-140.dat upx behavioral2/files/0x0007000000022dbc-142.dat upx behavioral2/files/0x0007000000022dba-138.dat upx behavioral2/files/0x0007000000022dbd-144.dat upx behavioral2/files/0x0007000000022dbd-143.dat upx behavioral2/files/0x0007000000022dba-137.dat upx behavioral2/memory/5064-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3076-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1884-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/628-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3248-150-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1884-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/628-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3248-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000022dbc-155.dat upx behavioral2/memory/4436-156-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ynudqtiyza.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\goxtrfsh = "ynudqtiyza.exe" hxbwwjhedohzyaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mggolnvf = "hxbwwjhedohzyaq.exe" hxbwwjhedohzyaq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "zybvdzjpwdrir.exe" hxbwwjhedohzyaq.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run hxbwwjhedohzyaq.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: fkwkvpbr.exe File opened (read-only) \??\e: ynudqtiyza.exe File opened (read-only) \??\p: ynudqtiyza.exe File opened (read-only) \??\r: ynudqtiyza.exe File opened (read-only) \??\t: ynudqtiyza.exe File opened (read-only) \??\a: fkwkvpbr.exe File opened (read-only) \??\u: fkwkvpbr.exe File opened (read-only) \??\w: fkwkvpbr.exe File opened (read-only) \??\w: ynudqtiyza.exe File opened (read-only) \??\x: fkwkvpbr.exe File opened (read-only) \??\h: fkwkvpbr.exe File opened (read-only) \??\l: fkwkvpbr.exe File opened (read-only) \??\s: fkwkvpbr.exe File opened (read-only) \??\a: ynudqtiyza.exe File opened (read-only) \??\y: ynudqtiyza.exe File opened (read-only) \??\b: fkwkvpbr.exe File opened (read-only) \??\t: fkwkvpbr.exe File opened (read-only) \??\x: ynudqtiyza.exe File opened (read-only) \??\m: fkwkvpbr.exe File opened (read-only) \??\m: fkwkvpbr.exe File opened (read-only) \??\n: fkwkvpbr.exe File opened (read-only) \??\z: fkwkvpbr.exe File opened (read-only) \??\k: fkwkvpbr.exe File opened (read-only) \??\f: fkwkvpbr.exe File opened (read-only) \??\q: fkwkvpbr.exe File opened (read-only) \??\j: ynudqtiyza.exe File opened (read-only) \??\f: ynudqtiyza.exe File opened (read-only) \??\k: fkwkvpbr.exe File opened (read-only) \??\n: ynudqtiyza.exe File opened (read-only) \??\a: fkwkvpbr.exe File opened (read-only) \??\j: fkwkvpbr.exe File opened (read-only) \??\o: fkwkvpbr.exe File opened (read-only) \??\s: fkwkvpbr.exe File opened (read-only) \??\r: fkwkvpbr.exe File opened (read-only) \??\z: ynudqtiyza.exe File opened (read-only) \??\v: fkwkvpbr.exe File opened (read-only) \??\g: ynudqtiyza.exe File opened (read-only) \??\i: ynudqtiyza.exe File opened (read-only) \??\l: ynudqtiyza.exe File opened (read-only) \??\i: fkwkvpbr.exe File opened (read-only) \??\r: fkwkvpbr.exe File opened (read-only) \??\t: fkwkvpbr.exe File opened (read-only) \??\v: fkwkvpbr.exe File opened (read-only) \??\g: fkwkvpbr.exe File opened (read-only) \??\b: ynudqtiyza.exe File opened (read-only) \??\s: ynudqtiyza.exe File opened (read-only) \??\b: fkwkvpbr.exe File opened (read-only) \??\p: fkwkvpbr.exe File opened (read-only) \??\y: fkwkvpbr.exe File opened (read-only) \??\e: fkwkvpbr.exe File opened (read-only) \??\x: fkwkvpbr.exe File opened (read-only) \??\k: ynudqtiyza.exe File opened (read-only) \??\m: ynudqtiyza.exe File opened (read-only) \??\v: ynudqtiyza.exe File opened (read-only) \??\l: fkwkvpbr.exe File opened (read-only) \??\p: fkwkvpbr.exe File opened (read-only) \??\u: fkwkvpbr.exe File opened (read-only) \??\z: fkwkvpbr.exe File opened (read-only) \??\i: fkwkvpbr.exe File opened (read-only) \??\o: ynudqtiyza.exe File opened (read-only) \??\q: ynudqtiyza.exe File opened (read-only) \??\g: fkwkvpbr.exe File opened (read-only) \??\h: fkwkvpbr.exe File opened (read-only) \??\w: fkwkvpbr.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ynudqtiyza.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ynudqtiyza.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5064-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5064-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3076-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1884-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/628-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3248-150-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1884-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/628-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3248-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\zybvdzjpwdrir.exe 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ynudqtiyza.exe File created C:\Windows\SysWOW64\ynudqtiyza.exe 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe File opened for modification C:\Windows\SysWOW64\ynudqtiyza.exe 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe File opened for modification C:\Windows\SysWOW64\hxbwwjhedohzyaq.exe 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe File created C:\Windows\SysWOW64\fkwkvpbr.exe 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe File opened for modification C:\Windows\SysWOW64\fkwkvpbr.exe 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe File created C:\Windows\SysWOW64\zybvdzjpwdrir.exe 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe File created C:\Windows\SysWOW64\hxbwwjhedohzyaq.exe 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB6B121449039E952C8B9D232E8D4C4" 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184DC60F15E5DAB4B8C87C93ECE334CF" 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ynudqtiyza.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ynudqtiyza.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ynudqtiyza.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32352C769D2C83206D4677D4702F2DD77C8464D8" 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABDF9BCF916F2E7840C3B4B86EC3994B08B02FB43600233E2BE429A09D2" 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F66BC1FF6C22DCD172D0A88B7A9162" 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ynudqtiyza.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ynudqtiyza.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ynudqtiyza.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ynudqtiyza.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ynudqtiyza.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ynudqtiyza.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FFBFC8E485D8268913CD62D7DE6BC94E635594366456337D6ED" 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ynudqtiyza.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ynudqtiyza.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ynudqtiyza.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 4436 fkwkvpbr.exe 4436 fkwkvpbr.exe 4436 fkwkvpbr.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 1884 hxbwwjhedohzyaq.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 3076 ynudqtiyza.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 628 fkwkvpbr.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 3248 zybvdzjpwdrir.exe 4436 fkwkvpbr.exe 4436 fkwkvpbr.exe 4436 fkwkvpbr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 5064 wrote to memory of 3076 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 80 PID 5064 wrote to memory of 3076 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 80 PID 5064 wrote to memory of 3076 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 80 PID 5064 wrote to memory of 1884 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 83 PID 5064 wrote to memory of 1884 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 83 PID 5064 wrote to memory of 1884 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 83 PID 5064 wrote to memory of 628 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 81 PID 5064 wrote to memory of 628 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 81 PID 5064 wrote to memory of 628 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 81 PID 5064 wrote to memory of 3248 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 82 PID 5064 wrote to memory of 3248 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 82 PID 5064 wrote to memory of 3248 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 82 PID 5064 wrote to memory of 2168 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 84 PID 5064 wrote to memory of 2168 5064 47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe 84 PID 3076 wrote to memory of 4436 3076 ynudqtiyza.exe 86 PID 3076 wrote to memory of 4436 3076 ynudqtiyza.exe 86 PID 3076 wrote to memory of 4436 3076 ynudqtiyza.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe"C:\Users\Admin\AppData\Local\Temp\47801dcd076819577810a804980541992f0d4ec784ded37b697da696cffb2dfe.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\ynudqtiyza.exeynudqtiyza.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\fkwkvpbr.exeC:\Windows\system32\fkwkvpbr.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4436
-
-
-
C:\Windows\SysWOW64\fkwkvpbr.exefkwkvpbr.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:628
-
-
C:\Windows\SysWOW64\zybvdzjpwdrir.exezybvdzjpwdrir.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3248
-
-
C:\Windows\SysWOW64\hxbwwjhedohzyaq.exehxbwwjhedohzyaq.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1884
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵PID:2168
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5a5d25dc5d823d6628251c96cc8c3b798
SHA1e92dbadd3bdf662c8e2a22458f1e124fac9a0de6
SHA2568ce1928408800dfaf8b67ba3f027d51cf8fabf4a2a22fd48539d052384a3a077
SHA5128ffda98b34b4d3079ca1b88c1a5f7d43badfe0b09310f9ee6a679c24b0e1dde6819fe5eaf0ba60c76c97cc82210b71e0f97d9c9837ae2f086b424f46651a2216
-
Filesize
255KB
MD5a5d25dc5d823d6628251c96cc8c3b798
SHA1e92dbadd3bdf662c8e2a22458f1e124fac9a0de6
SHA2568ce1928408800dfaf8b67ba3f027d51cf8fabf4a2a22fd48539d052384a3a077
SHA5128ffda98b34b4d3079ca1b88c1a5f7d43badfe0b09310f9ee6a679c24b0e1dde6819fe5eaf0ba60c76c97cc82210b71e0f97d9c9837ae2f086b424f46651a2216
-
Filesize
255KB
MD5a5d25dc5d823d6628251c96cc8c3b798
SHA1e92dbadd3bdf662c8e2a22458f1e124fac9a0de6
SHA2568ce1928408800dfaf8b67ba3f027d51cf8fabf4a2a22fd48539d052384a3a077
SHA5128ffda98b34b4d3079ca1b88c1a5f7d43badfe0b09310f9ee6a679c24b0e1dde6819fe5eaf0ba60c76c97cc82210b71e0f97d9c9837ae2f086b424f46651a2216
-
Filesize
255KB
MD503283d0365ab7e4cb366f5611f37a87e
SHA1823e2613d84ae48790ab22ff25961980f722c2c3
SHA256b36f54225b08d4f1137dec2119efd7b4fd3e01f5f32020fccc24345bc797a93c
SHA512d895ebc436712500f501d79eafc533aedd5ad35f20a701f7aa069d5a6cdf4728bee8241596d82fc36ab5755413b8269a546f7b3091905188fffc2d1cfa272e17
-
Filesize
255KB
MD503283d0365ab7e4cb366f5611f37a87e
SHA1823e2613d84ae48790ab22ff25961980f722c2c3
SHA256b36f54225b08d4f1137dec2119efd7b4fd3e01f5f32020fccc24345bc797a93c
SHA512d895ebc436712500f501d79eafc533aedd5ad35f20a701f7aa069d5a6cdf4728bee8241596d82fc36ab5755413b8269a546f7b3091905188fffc2d1cfa272e17
-
Filesize
255KB
MD5731b7fcd3da1ff80ce4fd071657b97e0
SHA12c4ce17f9a80d2bfb974519f64e8c139373a733a
SHA2562b339d25bb24d63019f119fb4ef923468b1f437844333088c106a20fb92ee856
SHA5124832d155b32176a97684f3aa23bb3f37a690a1628a467d0e3d8f7f5ec1439bf058f94f7e7724d06092d07ef959920d9f58826ba16fdd92deab5431c3fecb4c22
-
Filesize
255KB
MD5731b7fcd3da1ff80ce4fd071657b97e0
SHA12c4ce17f9a80d2bfb974519f64e8c139373a733a
SHA2562b339d25bb24d63019f119fb4ef923468b1f437844333088c106a20fb92ee856
SHA5124832d155b32176a97684f3aa23bb3f37a690a1628a467d0e3d8f7f5ec1439bf058f94f7e7724d06092d07ef959920d9f58826ba16fdd92deab5431c3fecb4c22
-
Filesize
255KB
MD5aefb4c5d1713fe982d64c889454db5e6
SHA12f55aa870f927fc4b14ac419d42a96876b0ff637
SHA2561272a3ba3ea3fe9a402e6df2019ef8b9aa7882dce5ce89ea36eb33047ad36116
SHA5129bf205f37789ead3df0ce692b9ebff64e50ad0e8c85670ef8c9788f1c4b9064e99e6ad91abb3f417cc8cdef5816cd5c1a813f11765eb8aa5eb477a0fcff4715a
-
Filesize
255KB
MD5aefb4c5d1713fe982d64c889454db5e6
SHA12f55aa870f927fc4b14ac419d42a96876b0ff637
SHA2561272a3ba3ea3fe9a402e6df2019ef8b9aa7882dce5ce89ea36eb33047ad36116
SHA5129bf205f37789ead3df0ce692b9ebff64e50ad0e8c85670ef8c9788f1c4b9064e99e6ad91abb3f417cc8cdef5816cd5c1a813f11765eb8aa5eb477a0fcff4715a