c304dd95bf33a90bb6ebad01b01f048a25ac6610acc760c2e37cd0347536221f

Analysis

max time kernel
3s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1fff858f0e185cd9c660ddcafaabb996.exe
Size

512KB
MD5

1fff858f0e185cd9c660ddcafaabb996
SHA1

cc3ce809927b3892a840318c0fa0ada5d04460e5
SHA256

c304dd95bf33a90bb6ebad01b01f048a25ac6610acc760c2e37cd0347536221f
SHA512

965b3978c8c6b694ac8030abbaa755e2ee4bb73cd9550985e9c49eb884d326dcdfad0a38110d4dc5dc38c930a6957a0493f809232e0cdd61c083b397daf1b081
SSDEEP

6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hnemagsbir.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hnemagsbir.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	hnemagsbir.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hnemagsbir.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	1fff858f0e185cd9c660ddcafaabb996.exe

Executes dropped EXE 5 IoCs

pid	Process
1876	hnemagsbir.exe
1724	emrauizjbkirypi.exe
968	uxnwppxm.exe
1060	rqkvzauwpfwud.exe
444	uxnwppxm.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	hnemagsbir.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "rqkvzauwpfwud.exe"	emrauizjbkirypi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\weakcapj = "hnemagsbir.exe"	emrauizjbkirypi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctrodohq = "emrauizjbkirypi.exe"	emrauizjbkirypi.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	uxnwppxm.exe
File opened (read-only)	\??\j:	uxnwppxm.exe
File opened (read-only)	\??\l:	uxnwppxm.exe
File opened (read-only)	\??\w:	uxnwppxm.exe
File opened (read-only)	\??\o:	hnemagsbir.exe
File opened (read-only)	\??\q:	hnemagsbir.exe
File opened (read-only)	\??\u:	hnemagsbir.exe
File opened (read-only)	\??\p:	uxnwppxm.exe
File opened (read-only)	\??\p:	uxnwppxm.exe
File opened (read-only)	\??\t:	uxnwppxm.exe
File opened (read-only)	\??\b:	hnemagsbir.exe
File opened (read-only)	\??\k:	hnemagsbir.exe
File opened (read-only)	\??\r:	uxnwppxm.exe
File opened (read-only)	\??\x:	uxnwppxm.exe
File opened (read-only)	\??\m:	hnemagsbir.exe
File opened (read-only)	\??\x:	hnemagsbir.exe
File opened (read-only)	\??\h:	uxnwppxm.exe
File opened (read-only)	\??\s:	uxnwppxm.exe
File opened (read-only)	\??\m:	uxnwppxm.exe
File opened (read-only)	\??\q:	uxnwppxm.exe
File opened (read-only)	\??\v:	uxnwppxm.exe
File opened (read-only)	\??\y:	uxnwppxm.exe
File opened (read-only)	\??\w:	uxnwppxm.exe
File opened (read-only)	\??\h:	uxnwppxm.exe
File opened (read-only)	\??\n:	uxnwppxm.exe
File opened (read-only)	\??\v:	uxnwppxm.exe
File opened (read-only)	\??\z:	uxnwppxm.exe
File opened (read-only)	\??\o:	uxnwppxm.exe
File opened (read-only)	\??\g:	uxnwppxm.exe
File opened (read-only)	\??\l:	uxnwppxm.exe
File opened (read-only)	\??\b:	uxnwppxm.exe
File opened (read-only)	\??\g:	uxnwppxm.exe
File opened (read-only)	\??\k:	uxnwppxm.exe
File opened (read-only)	\??\j:	hnemagsbir.exe
File opened (read-only)	\??\r:	hnemagsbir.exe
File opened (read-only)	\??\x:	uxnwppxm.exe
File opened (read-only)	\??\e:	hnemagsbir.exe
File opened (read-only)	\??\h:	hnemagsbir.exe
File opened (read-only)	\??\b:	uxnwppxm.exe
File opened (read-only)	\??\t:	hnemagsbir.exe
File opened (read-only)	\??\k:	uxnwppxm.exe
File opened (read-only)	\??\w:	hnemagsbir.exe
File opened (read-only)	\??\a:	uxnwppxm.exe
File opened (read-only)	\??\u:	uxnwppxm.exe
File opened (read-only)	\??\g:	hnemagsbir.exe
File opened (read-only)	\??\l:	hnemagsbir.exe
File opened (read-only)	\??\n:	hnemagsbir.exe
File opened (read-only)	\??\v:	hnemagsbir.exe
File opened (read-only)	\??\o:	uxnwppxm.exe
File opened (read-only)	\??\u:	uxnwppxm.exe
File opened (read-only)	\??\z:	hnemagsbir.exe
File opened (read-only)	\??\e:	uxnwppxm.exe
File opened (read-only)	\??\i:	uxnwppxm.exe
File opened (read-only)	\??\r:	uxnwppxm.exe
File opened (read-only)	\??\s:	hnemagsbir.exe
File opened (read-only)	\??\j:	uxnwppxm.exe
File opened (read-only)	\??\e:	uxnwppxm.exe
File opened (read-only)	\??\z:	uxnwppxm.exe
File opened (read-only)	\??\a:	hnemagsbir.exe
File opened (read-only)	\??\y:	hnemagsbir.exe
File opened (read-only)	\??\t:	uxnwppxm.exe
File opened (read-only)	\??\s:	uxnwppxm.exe
File opened (read-only)	\??\p:	hnemagsbir.exe
File opened (read-only)	\??\m:	uxnwppxm.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	hnemagsbir.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	hnemagsbir.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4516-0-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
behavioral2/files/0x0007000000023203-5.dat	autoit_exe
behavioral2/files/0x0007000000023200-18.dat	autoit_exe
behavioral2/files/0x0007000000023203-23.dat	autoit_exe
behavioral2/files/0x0007000000023200-19.dat	autoit_exe
behavioral2/files/0x000500000001e50a-114.dat	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\uxnwppxm.exe	1fff858f0e185cd9c660ddcafaabb996.exe
File opened for modification	C:\Windows\SysWOW64\uxnwppxm.exe	1fff858f0e185cd9c660ddcafaabb996.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	hnemagsbir.exe
File opened for modification	C:\Windows\SysWOW64\hnemagsbir.exe	1fff858f0e185cd9c660ddcafaabb996.exe
File created	C:\Windows\SysWOW64\emrauizjbkirypi.exe	1fff858f0e185cd9c660ddcafaabb996.exe
File opened for modification	C:\Windows\SysWOW64\emrauizjbkirypi.exe	1fff858f0e185cd9c660ddcafaabb996.exe
File created	C:\Windows\SysWOW64\rqkvzauwpfwud.exe	1fff858f0e185cd9c660ddcafaabb996.exe
File opened for modification	C:\Windows\SysWOW64\rqkvzauwpfwud.exe	1fff858f0e185cd9c660ddcafaabb996.exe
File created	C:\Windows\SysWOW64\hnemagsbir.exe	1fff858f0e185cd9c660ddcafaabb996.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	1fff858f0e185cd9c660ddcafaabb996.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	hnemagsbir.exe
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	1fff858f0e185cd9c660ddcafaabb996.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F66BB0FE1C21AAD273D0D68B799160"	1fff858f0e185cd9c660ddcafaabb996.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	hnemagsbir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	hnemagsbir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	hnemagsbir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB7B05B47E0389E52CEB9D2339DD7CB"	1fff858f0e185cd9c660ddcafaabb996.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F88FCF9482B82689032D75F7E90BC95E632594166406244D790"	1fff858f0e185cd9c660ddcafaabb996.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	hnemagsbir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	hnemagsbir.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	1fff858f0e185cd9c660ddcafaabb996.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322C769C2C83526A4676D777252CDC7D8765DB"	1fff858f0e185cd9c660ddcafaabb996.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACFFAB9FE16F19884753B3181EA39E2B08D02FF4361023BE2BE459908A3"	1fff858f0e185cd9c660ddcafaabb996.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	hnemagsbir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	hnemagsbir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	hnemagsbir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183AC77514E0DAB4B8C07C90ED9637C8"	1fff858f0e185cd9c660ddcafaabb996.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	hnemagsbir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	hnemagsbir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	hnemagsbir.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
444	uxnwppxm.exe
444	uxnwppxm.exe
444	uxnwppxm.exe
444	uxnwppxm.exe
444	uxnwppxm.exe
444	uxnwppxm.exe
444	uxnwppxm.exe
444	uxnwppxm.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
444	uxnwppxm.exe
444	uxnwppxm.exe
444	uxnwppxm.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
4516	1fff858f0e185cd9c660ddcafaabb996.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1876	hnemagsbir.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
1724	emrauizjbkirypi.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
968	uxnwppxm.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
1060	rqkvzauwpfwud.exe
444	uxnwppxm.exe
444	uxnwppxm.exe
444	uxnwppxm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2340	WINWORD.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 1876	4516	1fff858f0e185cd9c660ddcafaabb996.exe	97
PID 4516 wrote to memory of 1876	4516	1fff858f0e185cd9c660ddcafaabb996.exe	97
PID 4516 wrote to memory of 1876	4516	1fff858f0e185cd9c660ddcafaabb996.exe	97
PID 4516 wrote to memory of 1724	4516	1fff858f0e185cd9c660ddcafaabb996.exe	92
PID 4516 wrote to memory of 1724	4516	1fff858f0e185cd9c660ddcafaabb996.exe	92
PID 4516 wrote to memory of 1724	4516	1fff858f0e185cd9c660ddcafaabb996.exe	92
PID 4516 wrote to memory of 968	4516	1fff858f0e185cd9c660ddcafaabb996.exe	91
PID 4516 wrote to memory of 968	4516	1fff858f0e185cd9c660ddcafaabb996.exe	91
PID 4516 wrote to memory of 968	4516	1fff858f0e185cd9c660ddcafaabb996.exe	91
PID 4516 wrote to memory of 1060	4516	1fff858f0e185cd9c660ddcafaabb996.exe	90
PID 4516 wrote to memory of 1060	4516	1fff858f0e185cd9c660ddcafaabb996.exe	90
PID 4516 wrote to memory of 1060	4516	1fff858f0e185cd9c660ddcafaabb996.exe	90
PID 1876 wrote to memory of 444	1876	hnemagsbir.exe	93
PID 1876 wrote to memory of 444	1876	hnemagsbir.exe	93
PID 1876 wrote to memory of 444	1876	hnemagsbir.exe	93
PID 4516 wrote to memory of 2340	4516	1fff858f0e185cd9c660ddcafaabb996.exe	95
PID 4516 wrote to memory of 2340	4516	1fff858f0e185cd9c660ddcafaabb996.exe	95

C:\Users\Admin\AppData\Local\Temp\1fff858f0e185cd9c660ddcafaabb996.exe
"C:\Users\Admin\AppData\Local\Temp\1fff858f0e185cd9c660ddcafaabb996.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\SysWOW64\rqkvzauwpfwud.exe
  rqkvzauwpfwud.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1060
- C:\Windows\SysWOW64\uxnwppxm.exe
  uxnwppxm.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:968
- C:\Windows\SysWOW64\emrauizjbkirypi.exe
  emrauizjbkirypi.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1724
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2340
- C:\Windows\SysWOW64\hnemagsbir.exe
  hnemagsbir.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1876

C:\Windows\SysWOW64\uxnwppxm.exe
C:\Windows\system32\uxnwppxm.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\emrauizjbkirypi.exe

Filesize
93KB

MD5
257f28bd5bdc2b725434b7ab570814e7

SHA1
972446e0f8d210c5d6f42a57a921391a236d564d

SHA256
d80f45a5995ba038d69dbe87f7c12827ffa2b53e79beedb0bc6ee91c10a61688

SHA512
c27aa91c3c3605941a1a121021c840fc7886cf27d43e9d6b2c371888a276d9dfd39135600a4f933f62dfa3d46cb6e12de6e31b3f8b939676701ff37f8cc61575

Download Submit
C:\Windows\SysWOW64\hnemagsbir.exe

Filesize
381KB

MD5
30aec9e0b33fbd99234328357879f812

SHA1
3c9d37139d4ccfe2b694afba9633170d0f510a92

SHA256
15aad0daaaeea2f1eb8d19a8999f42844b2885d6bef949f6787feba7dad46563

SHA512
2060f2cc8c90181dd0a9965f0ff3a94aece08c82c4a68454846f66778bc60dade3ba5ddc38be57311ff4a7bd78217b89a9cd09837eee4b5d9893277299dad415

Download Submit
C:\Windows\SysWOW64\hnemagsbir.exe

Filesize
92KB

MD5
6662b185f19fbf697c56a25c92de7961

SHA1
0df0c0df0de3724258df2549c583e3c934aca726

SHA256
c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

SHA512
c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

Download Submit
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

Filesize
3KB

MD5
7bbaa1b6753e33c240d1401901f4b6ee

SHA1
5dfa8672a3fe13adfe048efed520b212e126d5a0

SHA256
48e5a5bf2abf5024152c055f5cebd948e106ea3b2de7b77479cf9600afbc6720

SHA512
9adb2d937d72ca525bfe724f3c866e2ef41b80548eefe5c812306a9877f75e47bc20249133a3b97a793eb767c03bf52a3fd0a470a2db2aa593a4199b9cb46fbb

Download Submit
memory/2340-55-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-50-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-43-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-45-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-46-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-47-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-48-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-42-0x00007FF9FAC10000-0x00007FF9FAC20000-memory.dmp

Filesize
64KB

Download
memory/2340-51-0x00007FF9F8820000-0x00007FF9F8830000-memory.dmp

Filesize
64KB

Download
memory/2340-52-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-53-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-137-0x00007FF9FAC10000-0x00007FF9FAC20000-memory.dmp

Filesize
64KB

Download
memory/2340-54-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-44-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-56-0x00007FF9F8820000-0x00007FF9F8830000-memory.dmp

Filesize
64KB

Download
memory/2340-49-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-40-0x00007FF9FAC10000-0x00007FF9FAC20000-memory.dmp

Filesize
64KB

Download
memory/2340-39-0x00007FF9FAC10000-0x00007FF9FAC20000-memory.dmp

Filesize
64KB

Download
memory/2340-38-0x00007FF9FAC10000-0x00007FF9FAC20000-memory.dmp

Filesize
64KB

Download
memory/2340-37-0x00007FF9FAC10000-0x00007FF9FAC20000-memory.dmp

Filesize
64KB

Download
memory/2340-100-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-41-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-140-0x00007FF9FAC10000-0x00007FF9FAC20000-memory.dmp

Filesize
64KB

Download
memory/2340-141-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-142-0x00007FFA3AB90000-0x00007FFA3AD85000-memory.dmp

Filesize
2.0MB

Download
memory/2340-139-0x00007FF9FAC10000-0x00007FF9FAC20000-memory.dmp

Filesize
64KB

Download
memory/2340-138-0x00007FF9FAC10000-0x00007FF9FAC20000-memory.dmp

Filesize
64KB

Download
memory/4516-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download