Analysis
-
max time kernel
209s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 19:09
Behavioral task
behavioral1
Sample
8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe
Resource
win7-20221111-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe
-
Size
255KB
-
MD5
e2c04a30160326d3dd99f42e7a98ed22
-
SHA1
3eb971e21654e3b02ec1a5307469f12bbc6c6f35
-
SHA256
8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8
-
SHA512
3ca676c2908fce970ab8c142591b03d78929ee1a7a51efaa0df2031b41fe894c3a25b8c07445d94986823a89c9e2cc7fc3a4bda0ea6bb73b827a58d133fac058
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJJ:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI8
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" wzhaovyeym.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wzhaovyeym.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wzhaovyeym.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wzhaovyeym.exe -
Executes dropped EXE 5 IoCs
pid Process 3736 wzhaovyeym.exe 3188 uctpdlgtpcalkjz.exe 4548 mwglasty.exe 4264 jonswnnkuaffh.exe 4688 mwglasty.exe -
resource yara_rule behavioral2/memory/1872-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000600000001e7a7-134.dat upx behavioral2/files/0x000600000001e7a7-135.dat upx behavioral2/files/0x0005000000022646-137.dat upx behavioral2/memory/3736-139-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0005000000022646-138.dat upx behavioral2/files/0x000300000002264c-143.dat upx behavioral2/files/0x000300000002264c-142.dat upx behavioral2/memory/3188-141-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000400000002264e-146.dat upx behavioral2/files/0x000400000002264e-147.dat upx behavioral2/files/0x000300000002264c-149.dat upx behavioral2/memory/1872-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4264-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4688-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4548-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000600000002318b-161.dat upx behavioral2/files/0x000600000002318a-160.dat upx behavioral2/memory/3188-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3736-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4548-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4264-168-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4688-169-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wzhaovyeym.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jonswnnkuaffh.exe" uctpdlgtpcalkjz.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run uctpdlgtpcalkjz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vfysqxro = "wzhaovyeym.exe" uctpdlgtpcalkjz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uyseekda = "uctpdlgtpcalkjz.exe" uctpdlgtpcalkjz.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: mwglasty.exe File opened (read-only) \??\b: mwglasty.exe File opened (read-only) \??\g: mwglasty.exe File opened (read-only) \??\p: mwglasty.exe File opened (read-only) \??\s: wzhaovyeym.exe File opened (read-only) \??\q: mwglasty.exe File opened (read-only) \??\e: wzhaovyeym.exe File opened (read-only) \??\n: wzhaovyeym.exe File opened (read-only) \??\r: wzhaovyeym.exe File opened (read-only) \??\b: mwglasty.exe File opened (read-only) \??\e: mwglasty.exe File opened (read-only) \??\w: wzhaovyeym.exe File opened (read-only) \??\e: mwglasty.exe File opened (read-only) \??\v: mwglasty.exe File opened (read-only) \??\b: wzhaovyeym.exe File opened (read-only) \??\j: wzhaovyeym.exe File opened (read-only) \??\l: wzhaovyeym.exe File opened (read-only) \??\y: mwglasty.exe File opened (read-only) \??\t: wzhaovyeym.exe File opened (read-only) \??\f: mwglasty.exe File opened (read-only) \??\s: mwglasty.exe File opened (read-only) \??\o: mwglasty.exe File opened (read-only) \??\r: mwglasty.exe File opened (read-only) \??\f: mwglasty.exe File opened (read-only) \??\h: mwglasty.exe File opened (read-only) \??\j: mwglasty.exe File opened (read-only) \??\o: mwglasty.exe File opened (read-only) \??\r: mwglasty.exe File opened (read-only) \??\f: wzhaovyeym.exe File opened (read-only) \??\x: wzhaovyeym.exe File opened (read-only) \??\h: wzhaovyeym.exe File opened (read-only) \??\v: wzhaovyeym.exe File opened (read-only) \??\z: mwglasty.exe File opened (read-only) \??\p: wzhaovyeym.exe File opened (read-only) \??\u: wzhaovyeym.exe File opened (read-only) \??\i: mwglasty.exe File opened (read-only) \??\n: mwglasty.exe File opened (read-only) \??\u: mwglasty.exe File opened (read-only) \??\w: mwglasty.exe File opened (read-only) \??\x: mwglasty.exe File opened (read-only) \??\g: wzhaovyeym.exe File opened (read-only) \??\k: mwglasty.exe File opened (read-only) \??\t: mwglasty.exe File opened (read-only) \??\u: mwglasty.exe File opened (read-only) \??\z: mwglasty.exe File opened (read-only) \??\k: wzhaovyeym.exe File opened (read-only) \??\q: wzhaovyeym.exe File opened (read-only) \??\a: mwglasty.exe File opened (read-only) \??\m: mwglasty.exe File opened (read-only) \??\l: mwglasty.exe File opened (read-only) \??\y: mwglasty.exe File opened (read-only) \??\w: mwglasty.exe File opened (read-only) \??\x: mwglasty.exe File opened (read-only) \??\n: mwglasty.exe File opened (read-only) \??\p: mwglasty.exe File opened (read-only) \??\i: mwglasty.exe File opened (read-only) \??\a: wzhaovyeym.exe File opened (read-only) \??\g: mwglasty.exe File opened (read-only) \??\h: mwglasty.exe File opened (read-only) \??\j: mwglasty.exe File opened (read-only) \??\i: wzhaovyeym.exe File opened (read-only) \??\z: wzhaovyeym.exe File opened (read-only) \??\s: mwglasty.exe File opened (read-only) \??\v: mwglasty.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" wzhaovyeym.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" wzhaovyeym.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3736-139-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3188-141-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1872-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4264-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4688-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4548-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3188-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3736-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4548-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4264-168-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4688-169-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\jonswnnkuaffh.exe 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe File opened for modification C:\Windows\SysWOW64\jonswnnkuaffh.exe 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe File created C:\Windows\SysWOW64\wzhaovyeym.exe 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe File opened for modification C:\Windows\SysWOW64\wzhaovyeym.exe 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe File opened for modification C:\Windows\SysWOW64\uctpdlgtpcalkjz.exe 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll wzhaovyeym.exe File created C:\Windows\SysWOW64\uctpdlgtpcalkjz.exe 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe File created C:\Windows\SysWOW64\mwglasty.exe 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe File opened for modification C:\Windows\SysWOW64\mwglasty.exe 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mwglasty.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mwglasty.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mwglasty.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mwglasty.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mwglasty.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mwglasty.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mwglasty.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mwglasty.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mwglasty.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mwglasty.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mwglasty.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mwglasty.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mwglasty.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mwglasty.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mwglasty.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCFFACEFE10F29983743B36869C3E95B38F028C4369034CE1C542EA09A0" 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F76BB3FF6D22DBD108D1A68B7B9165" 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1945C77814E1DABEB8C17C94EDE534C8" 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat wzhaovyeym.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc wzhaovyeym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" wzhaovyeym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B02D479039EE53CFB9D133EAD4CF" 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" wzhaovyeym.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf wzhaovyeym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" wzhaovyeym.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh wzhaovyeym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" wzhaovyeym.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" wzhaovyeym.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32442D0D9C2183276A3377D6772F2CDB7C8764AF" 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFBFF88482E82129046D7297DE2BDE6E637594667416341D79C" 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" wzhaovyeym.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs wzhaovyeym.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg wzhaovyeym.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3920 WINWORD.EXE 3920 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 4548 mwglasty.exe 4548 mwglasty.exe 4548 mwglasty.exe 4548 mwglasty.exe 4548 mwglasty.exe 4548 mwglasty.exe 4548 mwglasty.exe 4548 mwglasty.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 4264 jonswnnkuaffh.exe 4688 mwglasty.exe 4688 mwglasty.exe 4688 mwglasty.exe 4688 mwglasty.exe 4688 mwglasty.exe 4688 mwglasty.exe 4264 jonswnnkuaffh.exe 4688 mwglasty.exe 4688 mwglasty.exe 4264 jonswnnkuaffh.exe 4264 jonswnnkuaffh.exe 4264 jonswnnkuaffh.exe 4264 jonswnnkuaffh.exe 4264 jonswnnkuaffh.exe 4264 jonswnnkuaffh.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 4548 mwglasty.exe 4548 mwglasty.exe 4548 mwglasty.exe 4264 jonswnnkuaffh.exe 4264 jonswnnkuaffh.exe 4264 jonswnnkuaffh.exe 4688 mwglasty.exe 4688 mwglasty.exe 4688 mwglasty.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3736 wzhaovyeym.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 3188 uctpdlgtpcalkjz.exe 4548 mwglasty.exe 4548 mwglasty.exe 4548 mwglasty.exe 4264 jonswnnkuaffh.exe 4264 jonswnnkuaffh.exe 4264 jonswnnkuaffh.exe 4688 mwglasty.exe 4688 mwglasty.exe 4688 mwglasty.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3920 WINWORD.EXE 3920 WINWORD.EXE 3920 WINWORD.EXE 3920 WINWORD.EXE 3920 WINWORD.EXE 3920 WINWORD.EXE 3920 WINWORD.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1872 wrote to memory of 3736 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 82 PID 1872 wrote to memory of 3736 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 82 PID 1872 wrote to memory of 3736 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 82 PID 1872 wrote to memory of 3188 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 83 PID 1872 wrote to memory of 3188 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 83 PID 1872 wrote to memory of 3188 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 83 PID 1872 wrote to memory of 4548 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 84 PID 1872 wrote to memory of 4548 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 84 PID 1872 wrote to memory of 4548 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 84 PID 3188 wrote to memory of 4520 3188 uctpdlgtpcalkjz.exe 85 PID 3188 wrote to memory of 4520 3188 uctpdlgtpcalkjz.exe 85 PID 3188 wrote to memory of 4520 3188 uctpdlgtpcalkjz.exe 85 PID 1872 wrote to memory of 4264 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 87 PID 1872 wrote to memory of 4264 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 87 PID 1872 wrote to memory of 4264 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 87 PID 3736 wrote to memory of 4688 3736 wzhaovyeym.exe 88 PID 3736 wrote to memory of 4688 3736 wzhaovyeym.exe 88 PID 3736 wrote to memory of 4688 3736 wzhaovyeym.exe 88 PID 1872 wrote to memory of 3920 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 89 PID 1872 wrote to memory of 3920 1872 8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe"C:\Users\Admin\AppData\Local\Temp\8ad6e4f0b1e07db95297de63b193bdd90fc9070b3f852658d218b958407d06f8.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\wzhaovyeym.exewzhaovyeym.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\mwglasty.exeC:\Windows\system32\mwglasty.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4688
-
-
-
C:\Windows\SysWOW64\uctpdlgtpcalkjz.exeuctpdlgtpcalkjz.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.execmd.exe /c jonswnnkuaffh.exe3⤵PID:4520
-
-
-
C:\Windows\SysWOW64\mwglasty.exemwglasty.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4548
-
-
C:\Windows\SysWOW64\jonswnnkuaffh.exejonswnnkuaffh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4264
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3920
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5920aac32cbb44eaa5156b8698d004a7d
SHA13dd9071e9eeed35d49cf70a5bd4b0b3d66a9f4fc
SHA2565bd5f9a3816dd66884a0b34d8b1024adb5841cbf34fe88fb4a7e5feca22a27bd
SHA512db333cfba0914804fa89e07524f7c83f8247897c7620daa763c6890e19b005564761cf586f720a8f6c4941aba1fd2d1baf395848e9a8ee6d42bf672d530dfda1
-
Filesize
255KB
MD580aa9570a0fcbead10ae33615c31a1bf
SHA1ddf2a4ab067d8d488bf64896897b134bfa5b3a4d
SHA25656df546e1fcaf11f0c099759ff09730cc02cc131cd0deff53e458b509bfee669
SHA512cc8e73bb8c6e74004fedfa171118b878630b85144d951c47e307d9b38ddb97dd1448a96e27f2c383546c569d506324a306f75bc5259666880fdd77b029aa10c8
-
Filesize
255KB
MD580aa9570a0fcbead10ae33615c31a1bf
SHA1ddf2a4ab067d8d488bf64896897b134bfa5b3a4d
SHA25656df546e1fcaf11f0c099759ff09730cc02cc131cd0deff53e458b509bfee669
SHA512cc8e73bb8c6e74004fedfa171118b878630b85144d951c47e307d9b38ddb97dd1448a96e27f2c383546c569d506324a306f75bc5259666880fdd77b029aa10c8
-
Filesize
255KB
MD53eace816139ae7f2ba06fad380d410c2
SHA1d6391eb95633bd4fec2b204d0058aa3cda335d1a
SHA2564762d0b1109472a15ac9bb24054c34db64357ddad59b4b160bde1355eaee6a8f
SHA5124ec8549af9cda9086f7c825f2d195fdb4f0d338eed78c070ccd9ad699e0df5cc41a89d3117a12677e38af6c39f23084b6b02627e423d9c05af7601cea8416a5c
-
Filesize
255KB
MD53eace816139ae7f2ba06fad380d410c2
SHA1d6391eb95633bd4fec2b204d0058aa3cda335d1a
SHA2564762d0b1109472a15ac9bb24054c34db64357ddad59b4b160bde1355eaee6a8f
SHA5124ec8549af9cda9086f7c825f2d195fdb4f0d338eed78c070ccd9ad699e0df5cc41a89d3117a12677e38af6c39f23084b6b02627e423d9c05af7601cea8416a5c
-
Filesize
255KB
MD53eace816139ae7f2ba06fad380d410c2
SHA1d6391eb95633bd4fec2b204d0058aa3cda335d1a
SHA2564762d0b1109472a15ac9bb24054c34db64357ddad59b4b160bde1355eaee6a8f
SHA5124ec8549af9cda9086f7c825f2d195fdb4f0d338eed78c070ccd9ad699e0df5cc41a89d3117a12677e38af6c39f23084b6b02627e423d9c05af7601cea8416a5c
-
Filesize
255KB
MD58c04d67482ff2bb77222ec7d3f6ec2b5
SHA1ff0f74dc9c9341aa82c4f514659f8c7de7ead3e0
SHA25699458b23e6de1861dd4c39c27cfd77d4a60b52759dd39ee272147df47f2df867
SHA512bff2a36329b728fb7e906ac69be7133977cf822744b0132f7b7eb71700ab88bb4aa8bf1f41ec8a63654811bea5a904b17d86a8f26f533482d7fdab55d7115265
-
Filesize
255KB
MD58c04d67482ff2bb77222ec7d3f6ec2b5
SHA1ff0f74dc9c9341aa82c4f514659f8c7de7ead3e0
SHA25699458b23e6de1861dd4c39c27cfd77d4a60b52759dd39ee272147df47f2df867
SHA512bff2a36329b728fb7e906ac69be7133977cf822744b0132f7b7eb71700ab88bb4aa8bf1f41ec8a63654811bea5a904b17d86a8f26f533482d7fdab55d7115265
-
Filesize
255KB
MD5f340dcd18d4e8afc5aa72a0e186cac57
SHA11975eb0cb8285c8350f4b0b408219ad650705452
SHA256996929dbec081cd1a661925a2b9fe18e29693822fcd307ba11634ed113dba0eb
SHA51265a70886f8aaa3951a2b2d57f406a003748b7ef196c4371235e9d86ac04686c27e0c7ccbb864dd528d280e5fa571adc3f21c8ef497f0d78b0f540ed6c586a2e6
-
Filesize
255KB
MD5f340dcd18d4e8afc5aa72a0e186cac57
SHA11975eb0cb8285c8350f4b0b408219ad650705452
SHA256996929dbec081cd1a661925a2b9fe18e29693822fcd307ba11634ed113dba0eb
SHA51265a70886f8aaa3951a2b2d57f406a003748b7ef196c4371235e9d86ac04686c27e0c7ccbb864dd528d280e5fa571adc3f21c8ef497f0d78b0f540ed6c586a2e6
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5630ee8c6f72bf2b648f4e5876203909f
SHA1f58ec91bc1509bac272a4bf8336ef07fc0bc9209
SHA2569dbec191ae400a5166cf02ec6fa2348e6da9d0d9f8604a4ef867432275aaac7d
SHA512da8a0e5cefd8447d95cfe60df11379446d20e07f1d6a38acd3c64f9157d95a52e4b36aa08a43c36bda7bb272d7d1b2c7a015760e4f84d3e0902c9feef0bac2be