Analysis
-
max time kernel
281s -
max time network
351s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 19:03
Behavioral task
behavioral1
Sample
3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe
Resource
win7-20221111-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
20 signatures
150 seconds
General
-
Target
3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe
-
Size
255KB
-
MD5
036c4c82e2f6756c974041b9e07e85f4
-
SHA1
9cf4503c580220664ab22b34126ed6ded430bda2
-
SHA256
3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930
-
SHA512
9cae9f0d2324ef3c2c50c3d0271c0ad577820a4cd2372dd048c6f72660c0ca554f72a3c47227e46e5b594491d5a0424ea5d1975f433240f788e7edfde8cb0af5
-
SSDEEP
6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6u:Plf5j6zCNa0xeE3mh
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" nzvplaadnh.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nzvplaadnh.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nzvplaadnh.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nzvplaadnh.exe -
Executes dropped EXE 5 IoCs
pid Process 1380 nzvplaadnh.exe 4716 zgovtjynioguvjv.exe 2820 tkkklyft.exe 3384 qkjpahkgkmhsy.exe 1500 tkkklyft.exe -
resource yara_rule behavioral2/memory/4796-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4796-133-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000d000000022dd9-135.dat upx behavioral2/files/0x000d000000022dd9-136.dat upx behavioral2/memory/1380-137-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000f000000022ddc-139.dat upx behavioral2/files/0x000f000000022ddc-140.dat upx behavioral2/memory/4716-141-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0009000000022def-143.dat upx behavioral2/files/0x0009000000022df8-145.dat upx behavioral2/memory/2820-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4716-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0009000000022def-148.dat upx behavioral2/files/0x0009000000022df8-149.dat upx behavioral2/files/0x0009000000022def-151.dat upx behavioral2/memory/4796-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1500-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1500-155-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nzvplaadnh.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xymbgysa = "nzvplaadnh.exe" zgovtjynioguvjv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hsoacrjc = "zgovtjynioguvjv.exe" zgovtjynioguvjv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "qkjpahkgkmhsy.exe" zgovtjynioguvjv.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run zgovtjynioguvjv.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\l: tkkklyft.exe File opened (read-only) \??\i: tkkklyft.exe File opened (read-only) \??\y: nzvplaadnh.exe File opened (read-only) \??\p: tkkklyft.exe File opened (read-only) \??\a: tkkklyft.exe File opened (read-only) \??\n: tkkklyft.exe File opened (read-only) \??\a: nzvplaadnh.exe File opened (read-only) \??\i: tkkklyft.exe File opened (read-only) \??\k: tkkklyft.exe File opened (read-only) \??\v: tkkklyft.exe File opened (read-only) \??\f: tkkklyft.exe File opened (read-only) \??\f: nzvplaadnh.exe File opened (read-only) \??\x: tkkklyft.exe File opened (read-only) \??\e: tkkklyft.exe File opened (read-only) \??\t: nzvplaadnh.exe File opened (read-only) \??\o: tkkklyft.exe File opened (read-only) \??\p: tkkklyft.exe File opened (read-only) \??\k: nzvplaadnh.exe File opened (read-only) \??\s: tkkklyft.exe File opened (read-only) \??\w: tkkklyft.exe File opened (read-only) \??\o: nzvplaadnh.exe File opened (read-only) \??\h: tkkklyft.exe File opened (read-only) \??\y: tkkklyft.exe File opened (read-only) \??\z: tkkklyft.exe File opened (read-only) \??\q: nzvplaadnh.exe File opened (read-only) \??\r: tkkklyft.exe File opened (read-only) \??\o: tkkklyft.exe File opened (read-only) \??\t: tkkklyft.exe File opened (read-only) \??\j: nzvplaadnh.exe File opened (read-only) \??\l: nzvplaadnh.exe File opened (read-only) \??\g: tkkklyft.exe File opened (read-only) \??\r: tkkklyft.exe File opened (read-only) \??\x: tkkklyft.exe File opened (read-only) \??\u: tkkklyft.exe File opened (read-only) \??\k: tkkklyft.exe File opened (read-only) \??\m: tkkklyft.exe File opened (read-only) \??\s: tkkklyft.exe File opened (read-only) \??\u: tkkklyft.exe File opened (read-only) \??\v: tkkklyft.exe File opened (read-only) \??\m: nzvplaadnh.exe File opened (read-only) \??\e: tkkklyft.exe File opened (read-only) \??\z: tkkklyft.exe File opened (read-only) \??\t: tkkklyft.exe File opened (read-only) \??\b: nzvplaadnh.exe File opened (read-only) \??\h: nzvplaadnh.exe File opened (read-only) \??\i: nzvplaadnh.exe File opened (read-only) \??\p: nzvplaadnh.exe File opened (read-only) \??\r: nzvplaadnh.exe File opened (read-only) \??\z: nzvplaadnh.exe File opened (read-only) \??\f: tkkklyft.exe File opened (read-only) \??\b: tkkklyft.exe File opened (read-only) \??\e: nzvplaadnh.exe File opened (read-only) \??\u: nzvplaadnh.exe File opened (read-only) \??\q: tkkklyft.exe File opened (read-only) \??\h: tkkklyft.exe File opened (read-only) \??\l: tkkklyft.exe File opened (read-only) \??\g: nzvplaadnh.exe File opened (read-only) \??\n: nzvplaadnh.exe File opened (read-only) \??\s: nzvplaadnh.exe File opened (read-only) \??\w: nzvplaadnh.exe File opened (read-only) \??\b: tkkklyft.exe File opened (read-only) \??\j: tkkklyft.exe File opened (read-only) \??\j: tkkklyft.exe File opened (read-only) \??\q: tkkklyft.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" nzvplaadnh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" nzvplaadnh.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1380-137-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4716-141-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4716-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4796-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1500-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1500-155-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\tkkklyft.exe 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe File created C:\Windows\SysWOW64\zgovtjynioguvjv.exe 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe File opened for modification C:\Windows\SysWOW64\zgovtjynioguvjv.exe 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe File opened for modification C:\Windows\SysWOW64\tkkklyft.exe 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe File created C:\Windows\SysWOW64\qkjpahkgkmhsy.exe 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe File opened for modification C:\Windows\SysWOW64\qkjpahkgkmhsy.exe 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll nzvplaadnh.exe File created C:\Windows\SysWOW64\nzvplaadnh.exe 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe File opened for modification C:\Windows\SysWOW64\nzvplaadnh.exe 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" nzvplaadnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg nzvplaadnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" nzvplaadnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc nzvplaadnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" nzvplaadnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33342D0D9D5682246A3076D170272CDA7D8064A8" 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFFACAF962F2E484743B4B81EB39E6B0FD02FB4316023CE2C842EA09D3" 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB0B12147E539E953B9B9A23293D4BB" 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F89FF8C482A826A9140D72F7DE5BD95E146594A674F6246D69D" 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C70B15EDDAC5B8BE7FE6ED9434CA" 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" nzvplaadnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" nzvplaadnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" nzvplaadnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs nzvplaadnh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08668C3FE6921DAD20ED1A78B7A916B" 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat nzvplaadnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh nzvplaadnh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf nzvplaadnh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 3384 qkjpahkgkmhsy.exe 2820 tkkklyft.exe 3384 qkjpahkgkmhsy.exe 2820 tkkklyft.exe 3384 qkjpahkgkmhsy.exe 2820 tkkklyft.exe 1500 tkkklyft.exe 1500 tkkklyft.exe 1500 tkkklyft.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 1380 nzvplaadnh.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 4716 zgovtjynioguvjv.exe 3384 qkjpahkgkmhsy.exe 2820 tkkklyft.exe 3384 qkjpahkgkmhsy.exe 2820 tkkklyft.exe 3384 qkjpahkgkmhsy.exe 2820 tkkklyft.exe 1500 tkkklyft.exe 1500 tkkklyft.exe 1500 tkkklyft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4796 wrote to memory of 1380 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 81 PID 4796 wrote to memory of 1380 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 81 PID 4796 wrote to memory of 1380 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 81 PID 4796 wrote to memory of 4716 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 82 PID 4796 wrote to memory of 4716 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 82 PID 4796 wrote to memory of 4716 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 82 PID 4796 wrote to memory of 2820 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 83 PID 4796 wrote to memory of 2820 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 83 PID 4796 wrote to memory of 2820 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 83 PID 4796 wrote to memory of 3384 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 84 PID 4796 wrote to memory of 3384 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 84 PID 4796 wrote to memory of 3384 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 84 PID 1380 wrote to memory of 1500 1380 nzvplaadnh.exe 87 PID 1380 wrote to memory of 1500 1380 nzvplaadnh.exe 87 PID 1380 wrote to memory of 1500 1380 nzvplaadnh.exe 87 PID 4796 wrote to memory of 3464 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 88 PID 4796 wrote to memory of 3464 4796 3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe"C:\Users\Admin\AppData\Local\Temp\3ca7555ede5cd1c574b1f44ec2115cf0245661080d91cb0f0a8fb1129ffc5930.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\nzvplaadnh.exenzvplaadnh.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\tkkklyft.exeC:\Windows\system32\tkkklyft.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1500
-
-
-
C:\Windows\SysWOW64\zgovtjynioguvjv.exezgovtjynioguvjv.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4716
-
-
C:\Windows\SysWOW64\tkkklyft.exetkkklyft.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2820
-
-
C:\Windows\SysWOW64\qkjpahkgkmhsy.exeqkjpahkgkmhsy.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3384
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵PID:3464
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD57d8f79a57b81ec0de2daf87f1f91ed33
SHA1a42a38640d742b15e31b702fa4016170925b2c6b
SHA256d44a70f702dbe8cc0e4a9f175b126f1736399a4731d71df961cd3fa205642539
SHA512a2bebf501e146abab8a67e180c9eda06bf84fd135530ec1e14769372777187db1b302d1df8883230d4f4cf13a3be73077cdf67119945a7874e839b66730d4b39
-
Filesize
255KB
MD57d8f79a57b81ec0de2daf87f1f91ed33
SHA1a42a38640d742b15e31b702fa4016170925b2c6b
SHA256d44a70f702dbe8cc0e4a9f175b126f1736399a4731d71df961cd3fa205642539
SHA512a2bebf501e146abab8a67e180c9eda06bf84fd135530ec1e14769372777187db1b302d1df8883230d4f4cf13a3be73077cdf67119945a7874e839b66730d4b39
-
Filesize
255KB
MD5e6318260d718d20562ce94204474fa2e
SHA15bbc4677fe864b8a71064499d34fe6b8a0599794
SHA25683e94d6275fc8f34f49402903f459ef894cd1889a55bc5940c9b1f98bb1c5ab9
SHA512a30246c34357dc9107641ef7c1022521072353b332e7bd7c5ccb34ecbbcd3b22449d0bc55be6b05d50e0f3f6bba896a0d6550c2ccbe2079b565b5a47d42b8c2b
-
Filesize
255KB
MD5e6318260d718d20562ce94204474fa2e
SHA15bbc4677fe864b8a71064499d34fe6b8a0599794
SHA25683e94d6275fc8f34f49402903f459ef894cd1889a55bc5940c9b1f98bb1c5ab9
SHA512a30246c34357dc9107641ef7c1022521072353b332e7bd7c5ccb34ecbbcd3b22449d0bc55be6b05d50e0f3f6bba896a0d6550c2ccbe2079b565b5a47d42b8c2b
-
Filesize
255KB
MD509484e9bdf99bef271d88bdc9946834d
SHA16c0d6a9411d0fe7588754c05aa73a2bb23b16acd
SHA25655ff3fafec5979be34e57344500a713656e56c4653fece43374548bebde87e08
SHA512d260d356c03f9f927c0a9e188c5af9315b261b4270dc9ae8b9574476e94a3a5739e48294d074ba0e265adb4935642b768dbcc01023d9791c108df25640f52877
-
Filesize
255KB
MD509484e9bdf99bef271d88bdc9946834d
SHA16c0d6a9411d0fe7588754c05aa73a2bb23b16acd
SHA25655ff3fafec5979be34e57344500a713656e56c4653fece43374548bebde87e08
SHA512d260d356c03f9f927c0a9e188c5af9315b261b4270dc9ae8b9574476e94a3a5739e48294d074ba0e265adb4935642b768dbcc01023d9791c108df25640f52877
-
Filesize
255KB
MD509484e9bdf99bef271d88bdc9946834d
SHA16c0d6a9411d0fe7588754c05aa73a2bb23b16acd
SHA25655ff3fafec5979be34e57344500a713656e56c4653fece43374548bebde87e08
SHA512d260d356c03f9f927c0a9e188c5af9315b261b4270dc9ae8b9574476e94a3a5739e48294d074ba0e265adb4935642b768dbcc01023d9791c108df25640f52877
-
Filesize
255KB
MD58ce2f6f0275397399d6ee4ae649e4956
SHA1b09a74a64a1a6bbd89dfcfde17da16408803bea2
SHA256ee0e3c8b438a699082187204295739f22f30a1a87c5e7a9b70d303a8de7fb15d
SHA51228a20c792cb03b6e929fa5346a1fa3c05cafe6de53debd28d1e13637e8471150099cbe8397bacd67394af6604e5f5e985b3f09d76f6bc92005c616a7431728ea
-
Filesize
255KB
MD58ce2f6f0275397399d6ee4ae649e4956
SHA1b09a74a64a1a6bbd89dfcfde17da16408803bea2
SHA256ee0e3c8b438a699082187204295739f22f30a1a87c5e7a9b70d303a8de7fb15d
SHA51228a20c792cb03b6e929fa5346a1fa3c05cafe6de53debd28d1e13637e8471150099cbe8397bacd67394af6604e5f5e985b3f09d76f6bc92005c616a7431728ea