Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 01:45
Behavioral task
behavioral1
Sample
1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe
Resource
win7-20221111-en
windows7-x64
24 signatures
150 seconds
General
-
Target
1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe
-
Size
255KB
-
MD5
673b0c17d383425b15975e13b093a2a6
-
SHA1
2fbfe60d07a1366a114df1a370bb024683dfc32c
-
SHA256
1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff
-
SHA512
28682150287b318e0c0a09eb9acd5822d2c1fc0a128723c1252cf336d937f112e870718c27a2405d723e7690e77426f5764e83d84200dee463e66237a3d976fc
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJp:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIg
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" icyanzawhu.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" icyanzawhu.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" icyanzawhu.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" icyanzawhu.exe -
Executes dropped EXE 5 IoCs
pid Process 4556 icyanzawhu.exe 1316 ukptpfxbtetvudm.exe 3440 zktmbowc.exe 5064 mpedrnmeafnke.exe 1764 zktmbowc.exe -
resource yara_rule behavioral2/memory/4952-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0007000000022e6d-134.dat upx behavioral2/files/0x0007000000022e6d-135.dat upx behavioral2/files/0x0007000000022e70-137.dat upx behavioral2/files/0x0007000000022e70-139.dat upx behavioral2/files/0x0006000000022e75-140.dat upx behavioral2/files/0x0006000000022e75-141.dat upx behavioral2/files/0x0006000000022e76-144.dat upx behavioral2/files/0x0006000000022e76-143.dat upx behavioral2/memory/4556-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1316-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3440-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5064-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0006000000022e75-150.dat upx behavioral2/memory/1764-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4952-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0006000000022e7a-155.dat upx behavioral2/files/0x0002000000009dee-154.dat upx behavioral2/memory/4556-164-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1316-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3440-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5064-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1764-168-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000300000001e3d9-169.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" icyanzawhu.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ukptpfxbtetvudm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bbmbsgyq = "icyanzawhu.exe" ukptpfxbtetvudm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tbfiuvrw = "ukptpfxbtetvudm.exe" ukptpfxbtetvudm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mpedrnmeafnke.exe" ukptpfxbtetvudm.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: zktmbowc.exe File opened (read-only) \??\h: zktmbowc.exe File opened (read-only) \??\q: zktmbowc.exe File opened (read-only) \??\i: icyanzawhu.exe File opened (read-only) \??\s: zktmbowc.exe File opened (read-only) \??\a: zktmbowc.exe File opened (read-only) \??\i: zktmbowc.exe File opened (read-only) \??\r: zktmbowc.exe File opened (read-only) \??\x: zktmbowc.exe File opened (read-only) \??\z: zktmbowc.exe File opened (read-only) \??\i: zktmbowc.exe File opened (read-only) \??\j: zktmbowc.exe File opened (read-only) \??\m: zktmbowc.exe File opened (read-only) \??\n: zktmbowc.exe File opened (read-only) \??\h: zktmbowc.exe File opened (read-only) \??\t: zktmbowc.exe File opened (read-only) \??\b: icyanzawhu.exe File opened (read-only) \??\v: icyanzawhu.exe File opened (read-only) \??\y: icyanzawhu.exe File opened (read-only) \??\a: zktmbowc.exe File opened (read-only) \??\g: zktmbowc.exe File opened (read-only) \??\r: zktmbowc.exe File opened (read-only) \??\u: zktmbowc.exe File opened (read-only) \??\z: zktmbowc.exe File opened (read-only) \??\b: zktmbowc.exe File opened (read-only) \??\h: icyanzawhu.exe File opened (read-only) \??\p: icyanzawhu.exe File opened (read-only) \??\o: zktmbowc.exe File opened (read-only) \??\q: zktmbowc.exe File opened (read-only) \??\t: zktmbowc.exe File opened (read-only) \??\u: zktmbowc.exe File opened (read-only) \??\q: icyanzawhu.exe File opened (read-only) \??\k: zktmbowc.exe File opened (read-only) \??\l: zktmbowc.exe File opened (read-only) \??\e: zktmbowc.exe File opened (read-only) \??\g: zktmbowc.exe File opened (read-only) \??\v: zktmbowc.exe File opened (read-only) \??\r: icyanzawhu.exe File opened (read-only) \??\z: icyanzawhu.exe File opened (read-only) \??\w: zktmbowc.exe File opened (read-only) \??\f: zktmbowc.exe File opened (read-only) \??\p: zktmbowc.exe File opened (read-only) \??\g: icyanzawhu.exe File opened (read-only) \??\n: icyanzawhu.exe File opened (read-only) \??\k: zktmbowc.exe File opened (read-only) \??\a: icyanzawhu.exe File opened (read-only) \??\j: icyanzawhu.exe File opened (read-only) \??\k: icyanzawhu.exe File opened (read-only) \??\t: icyanzawhu.exe File opened (read-only) \??\n: zktmbowc.exe File opened (read-only) \??\u: icyanzawhu.exe File opened (read-only) \??\p: zktmbowc.exe File opened (read-only) \??\y: zktmbowc.exe File opened (read-only) \??\j: zktmbowc.exe File opened (read-only) \??\m: zktmbowc.exe File opened (read-only) \??\y: zktmbowc.exe File opened (read-only) \??\e: icyanzawhu.exe File opened (read-only) \??\b: zktmbowc.exe File opened (read-only) \??\o: zktmbowc.exe File opened (read-only) \??\f: icyanzawhu.exe File opened (read-only) \??\w: icyanzawhu.exe File opened (read-only) \??\l: zktmbowc.exe File opened (read-only) \??\w: zktmbowc.exe File opened (read-only) \??\f: zktmbowc.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" icyanzawhu.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" icyanzawhu.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4952-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4556-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1316-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3440-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5064-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1764-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4952-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4556-164-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1316-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3440-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5064-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1764-168-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ukptpfxbtetvudm.exe 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe File created C:\Windows\SysWOW64\zktmbowc.exe 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe File created C:\Windows\SysWOW64\mpedrnmeafnke.exe 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe File created C:\Windows\SysWOW64\icyanzawhu.exe 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe File opened for modification C:\Windows\SysWOW64\icyanzawhu.exe 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe File opened for modification C:\Windows\SysWOW64\ukptpfxbtetvudm.exe 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe File opened for modification C:\Windows\SysWOW64\zktmbowc.exe 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe File opened for modification C:\Windows\SysWOW64\mpedrnmeafnke.exe 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll icyanzawhu.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zktmbowc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zktmbowc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zktmbowc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zktmbowc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zktmbowc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal zktmbowc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal zktmbowc.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zktmbowc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe zktmbowc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal zktmbowc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zktmbowc.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zktmbowc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal zktmbowc.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe zktmbowc.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh icyanzawhu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC1B121449539EF53CCBADD3392D7C5" 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1944C60815E4DAB2B9C17FE2ECE737CE" 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc icyanzawhu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" icyanzawhu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs icyanzawhu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" icyanzawhu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg icyanzawhu.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33352C7B9D2083276A3277A170272DD97D8665DC" 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" icyanzawhu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" icyanzawhu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F36BB7FE6921DAD173D0A98B09906B" 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat icyanzawhu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" icyanzawhu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf icyanzawhu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" icyanzawhu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCFFABFFE14F2E284093B4781EC3993B38B02F14213023FE2CB429D08A7" 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFCFE485C856E9041D7297DE7BD93E133594167326335D791" 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3088 WINWORD.EXE 3088 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 1764 zktmbowc.exe 1764 zktmbowc.exe 1764 zktmbowc.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 4556 icyanzawhu.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 1316 ukptpfxbtetvudm.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 3440 zktmbowc.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 5064 mpedrnmeafnke.exe 1764 zktmbowc.exe 1764 zktmbowc.exe 1764 zktmbowc.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3088 WINWORD.EXE 3088 WINWORD.EXE 3088 WINWORD.EXE 3088 WINWORD.EXE 3088 WINWORD.EXE 3088 WINWORD.EXE 3088 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4952 wrote to memory of 4556 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 81 PID 4952 wrote to memory of 4556 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 81 PID 4952 wrote to memory of 4556 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 81 PID 4952 wrote to memory of 1316 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 82 PID 4952 wrote to memory of 1316 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 82 PID 4952 wrote to memory of 1316 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 82 PID 4952 wrote to memory of 3440 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 83 PID 4952 wrote to memory of 3440 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 83 PID 4952 wrote to memory of 3440 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 83 PID 4952 wrote to memory of 5064 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 84 PID 4952 wrote to memory of 5064 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 84 PID 4952 wrote to memory of 5064 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 84 PID 4556 wrote to memory of 1764 4556 icyanzawhu.exe 85 PID 4556 wrote to memory of 1764 4556 icyanzawhu.exe 85 PID 4556 wrote to memory of 1764 4556 icyanzawhu.exe 85 PID 4952 wrote to memory of 3088 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 86 PID 4952 wrote to memory of 3088 4952 1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe"C:\Users\Admin\AppData\Local\Temp\1c1235b2a3876e07761c73df1712a5339a6791226623ba3511e8dfe3422a61ff.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Windows\SysWOW64\icyanzawhu.exeicyanzawhu.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\SysWOW64\zktmbowc.exeC:\Windows\system32\zktmbowc.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1764
-
-
-
C:\Windows\SysWOW64\ukptpfxbtetvudm.exeukptpfxbtetvudm.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1316
-
-
C:\Windows\SysWOW64\zktmbowc.exezktmbowc.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3440
-
-
C:\Windows\SysWOW64\mpedrnmeafnke.exempedrnmeafnke.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5064
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3088
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5e50c783da6def79a18023181d2dd04c1
SHA191381d1ddf1d9e712fa492b456ccd5e9a363d5e0
SHA256617b0b61f29aaebd24cdd422e2d0b35543b5ef4be6befdc7b688aa7bb9bf7d18
SHA512aef92d65335057cba2be0e0052b3e9ba7cd9e068e7d4b330e86f28bf6ccf8d19f34f76828be19ce12ca2a4685a483627a637f712255ae5453b5ec195e0316262
-
Filesize
255KB
MD56f0b715c3822ce1da35958adff9b437a
SHA114a7ad3f08e154e19008ad5420a5f49fc1380086
SHA2562cd978acc5a271c272048a053b9cf2f5dccc710db2116caa761f35332c76c662
SHA512bef64dbee594964afcf2065c6a026f47f6c22298fe67f27dc9cb4e450ff72b20609d30e692d86ec136d80368ac216d5b56cc457e88eae8d67a7656fc91d1a403
-
Filesize
255KB
MD583a859878b82d2293e5f595c0070d904
SHA11529aa3e99db51d20df37dc30581f256f7fc501e
SHA256f7b1c33f33065b5f72b87c54eb2188e8912b16d11c8256eb37d8abc55b0fb5b2
SHA51291a09151ef635d6fe8067f4b1f51c139ddfa4db746d0a8281a3836ef804341c3e9a086143d020ab46c3c5e124f307d07c5f81ceacab5b0fc132b0808458e868b
-
Filesize
255KB
MD5c82f5ebb02ce73e342ab32a42b030f74
SHA1317bf2b98478297f767efc4e7e39c50882129c37
SHA2568bedaa59d9a873ca9fb701637d460b6dd15e458f7c58a2d95eac4a1df462701b
SHA5120ea95576c47175b0a2c2be02144453573acb4aa28bb8ddb52bbf322768f5c4be257796b9afbac9c678430432825df37a09a805016c69a7eef200719a400f11c2
-
Filesize
255KB
MD5c82f5ebb02ce73e342ab32a42b030f74
SHA1317bf2b98478297f767efc4e7e39c50882129c37
SHA2568bedaa59d9a873ca9fb701637d460b6dd15e458f7c58a2d95eac4a1df462701b
SHA5120ea95576c47175b0a2c2be02144453573acb4aa28bb8ddb52bbf322768f5c4be257796b9afbac9c678430432825df37a09a805016c69a7eef200719a400f11c2
-
Filesize
255KB
MD512046d7d3fc2198de9a1ec4010e42f7e
SHA1c5806929fa7bf7217bffe8607fecbebdbe391495
SHA256df4b6c176ccd5b0aae96899de244d16293ed5d19563f86215d085580e219f0e2
SHA512e2d2adfb630ed725c704d1fdbeab30602c3652e842bf9f763dc6f42f1fabe908fb33e895063db4330a34fec90ae8066762abb4a1d5a53cf719d6538f7151a047
-
Filesize
255KB
MD512046d7d3fc2198de9a1ec4010e42f7e
SHA1c5806929fa7bf7217bffe8607fecbebdbe391495
SHA256df4b6c176ccd5b0aae96899de244d16293ed5d19563f86215d085580e219f0e2
SHA512e2d2adfb630ed725c704d1fdbeab30602c3652e842bf9f763dc6f42f1fabe908fb33e895063db4330a34fec90ae8066762abb4a1d5a53cf719d6538f7151a047
-
Filesize
255KB
MD59df020eb3a6f0ce68dfadb2c9f1514d7
SHA1db62d1a31295d82f8928417e07147f4c88ad3181
SHA2560f4c9064971f4b222ea43202a24241cd5f39d110a08d3a65239bc20a1b01abee
SHA512178959acc2522b76e1e614e73899d2d21a58c429860a0a372fd45091dcc2ce0085e25589ab2a9b57af4acc3cec6092db163e0a54cad47f8146ce939edd481340
-
Filesize
255KB
MD59df020eb3a6f0ce68dfadb2c9f1514d7
SHA1db62d1a31295d82f8928417e07147f4c88ad3181
SHA2560f4c9064971f4b222ea43202a24241cd5f39d110a08d3a65239bc20a1b01abee
SHA512178959acc2522b76e1e614e73899d2d21a58c429860a0a372fd45091dcc2ce0085e25589ab2a9b57af4acc3cec6092db163e0a54cad47f8146ce939edd481340
-
Filesize
255KB
MD57e4088ddf7ced396ec83a16d4d95e842
SHA15de567317f22a9f6b6a2c03314c79fd1a7501375
SHA25698ac58b259c27ef5a31b68ffe5e081bbe0f55894d3eadd9877d1f0ce2fc48bd8
SHA512643a3ca796417a065e535d5a07c15dc88fe6011c50e2494f404a89968e151e9e9020b119d0cd26a5494a068b0a510fe4d04fa13a872fddeb43ebedbde7d37dd2
-
Filesize
255KB
MD57e4088ddf7ced396ec83a16d4d95e842
SHA15de567317f22a9f6b6a2c03314c79fd1a7501375
SHA25698ac58b259c27ef5a31b68ffe5e081bbe0f55894d3eadd9877d1f0ce2fc48bd8
SHA512643a3ca796417a065e535d5a07c15dc88fe6011c50e2494f404a89968e151e9e9020b119d0cd26a5494a068b0a510fe4d04fa13a872fddeb43ebedbde7d37dd2
-
Filesize
255KB
MD57e4088ddf7ced396ec83a16d4d95e842
SHA15de567317f22a9f6b6a2c03314c79fd1a7501375
SHA25698ac58b259c27ef5a31b68ffe5e081bbe0f55894d3eadd9877d1f0ce2fc48bd8
SHA512643a3ca796417a065e535d5a07c15dc88fe6011c50e2494f404a89968e151e9e9020b119d0cd26a5494a068b0a510fe4d04fa13a872fddeb43ebedbde7d37dd2
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7