Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 11:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
6c291243393d267250d505ba4c27195a.exe
Resource
win7-20231215-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c291243393d267250d505ba4c27195a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
6c291243393d267250d505ba4c27195a.exe
-
Size
512KB
-
MD5
6c291243393d267250d505ba4c27195a
-
SHA1
7e83b699350852b83ea9a64143a3e1ebb958e677
-
SHA256
d74b4718c7a0600e9b5194f97ce96acffb96da0c7dd55da02fb5fee051e29ade
-
SHA512
dd9a19f454add4c7b2f3ddaa4804afee65e68e9409142cb8717ddd0ee80d59e54f3eb458c05f62fafd6d99439e5d04ab7675c6ba76781cb9ed3f15d8ed2e9202
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6K:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" nszynhsmaf.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nszynhsmaf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nszynhsmaf.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nszynhsmaf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 6c291243393d267250d505ba4c27195a.exe -
Executes dropped EXE 5 IoCs
pid Process 380 nszynhsmaf.exe 4904 cplmsbig.exe 3680 xcjlvlluubxdeoz.exe 3660 xwgefrkeoeelb.exe 3888 cplmsbig.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" nszynhsmaf.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dffsojtz = "nszynhsmaf.exe" xcjlvlluubxdeoz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sbkxuqxf = "xcjlvlluubxdeoz.exe" xcjlvlluubxdeoz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xwgefrkeoeelb.exe" xcjlvlluubxdeoz.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: cplmsbig.exe File opened (read-only) \??\b: cplmsbig.exe File opened (read-only) \??\v: cplmsbig.exe File opened (read-only) \??\g: cplmsbig.exe File opened (read-only) \??\e: cplmsbig.exe File opened (read-only) \??\p: cplmsbig.exe File opened (read-only) \??\z: cplmsbig.exe File opened (read-only) \??\q: cplmsbig.exe File opened (read-only) \??\w: nszynhsmaf.exe File opened (read-only) \??\w: cplmsbig.exe File opened (read-only) \??\x: nszynhsmaf.exe File opened (read-only) \??\q: cplmsbig.exe File opened (read-only) \??\x: cplmsbig.exe File opened (read-only) \??\y: cplmsbig.exe File opened (read-only) \??\b: cplmsbig.exe File opened (read-only) \??\w: cplmsbig.exe File opened (read-only) \??\h: nszynhsmaf.exe File opened (read-only) \??\n: nszynhsmaf.exe File opened (read-only) \??\s: nszynhsmaf.exe File opened (read-only) \??\a: cplmsbig.exe File opened (read-only) \??\k: cplmsbig.exe File opened (read-only) \??\a: nszynhsmaf.exe File opened (read-only) \??\i: nszynhsmaf.exe File opened (read-only) \??\o: nszynhsmaf.exe File opened (read-only) \??\v: nszynhsmaf.exe File opened (read-only) \??\k: cplmsbig.exe File opened (read-only) \??\n: cplmsbig.exe File opened (read-only) \??\p: cplmsbig.exe File opened (read-only) \??\s: cplmsbig.exe File opened (read-only) \??\e: nszynhsmaf.exe File opened (read-only) \??\t: nszynhsmaf.exe File opened (read-only) \??\z: nszynhsmaf.exe File opened (read-only) \??\m: cplmsbig.exe File opened (read-only) \??\o: cplmsbig.exe File opened (read-only) \??\t: cplmsbig.exe File opened (read-only) \??\m: nszynhsmaf.exe File opened (read-only) \??\r: nszynhsmaf.exe File opened (read-only) \??\g: nszynhsmaf.exe File opened (read-only) \??\h: cplmsbig.exe File opened (read-only) \??\r: cplmsbig.exe File opened (read-only) \??\u: cplmsbig.exe File opened (read-only) \??\l: cplmsbig.exe File opened (read-only) \??\j: cplmsbig.exe File opened (read-only) \??\r: cplmsbig.exe File opened (read-only) \??\v: cplmsbig.exe File opened (read-only) \??\u: nszynhsmaf.exe File opened (read-only) \??\i: cplmsbig.exe File opened (read-only) \??\i: cplmsbig.exe File opened (read-only) \??\l: cplmsbig.exe File opened (read-only) \??\m: cplmsbig.exe File opened (read-only) \??\y: cplmsbig.exe File opened (read-only) \??\j: cplmsbig.exe File opened (read-only) \??\t: cplmsbig.exe File opened (read-only) \??\x: cplmsbig.exe File opened (read-only) \??\q: nszynhsmaf.exe File opened (read-only) \??\a: cplmsbig.exe File opened (read-only) \??\g: cplmsbig.exe File opened (read-only) \??\u: cplmsbig.exe File opened (read-only) \??\y: nszynhsmaf.exe File opened (read-only) \??\n: cplmsbig.exe File opened (read-only) \??\o: cplmsbig.exe File opened (read-only) \??\h: cplmsbig.exe File opened (read-only) \??\j: nszynhsmaf.exe File opened (read-only) \??\k: nszynhsmaf.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" nszynhsmaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" nszynhsmaf.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2088-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00090000000231fc-5.dat autoit_exe behavioral2/files/0x000c000000023164-19.dat autoit_exe behavioral2/files/0x00090000000231fc-26.dat autoit_exe behavioral2/files/0x0007000000023202-27.dat autoit_exe behavioral2/files/0x000c000000023164-18.dat autoit_exe behavioral2/files/0x0007000000023202-32.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\xwgefrkeoeelb.exe 6c291243393d267250d505ba4c27195a.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll nszynhsmaf.exe File opened for modification C:\Windows\SysWOW64\nszynhsmaf.exe 6c291243393d267250d505ba4c27195a.exe File created C:\Windows\SysWOW64\xcjlvlluubxdeoz.exe 6c291243393d267250d505ba4c27195a.exe File opened for modification C:\Windows\SysWOW64\cplmsbig.exe 6c291243393d267250d505ba4c27195a.exe File opened for modification C:\Windows\SysWOW64\xwgefrkeoeelb.exe 6c291243393d267250d505ba4c27195a.exe File created C:\Windows\SysWOW64\nszynhsmaf.exe 6c291243393d267250d505ba4c27195a.exe File opened for modification C:\Windows\SysWOW64\xcjlvlluubxdeoz.exe 6c291243393d267250d505ba4c27195a.exe File created C:\Windows\SysWOW64\cplmsbig.exe 6c291243393d267250d505ba4c27195a.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cplmsbig.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cplmsbig.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cplmsbig.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cplmsbig.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cplmsbig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cplmsbig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cplmsbig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cplmsbig.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cplmsbig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cplmsbig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cplmsbig.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cplmsbig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cplmsbig.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cplmsbig.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cplmsbig.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 6c291243393d267250d505ba4c27195a.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc nszynhsmaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" nszynhsmaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" nszynhsmaf.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings 6c291243393d267250d505ba4c27195a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFACEF967F195840F3B3686973E94B38A028F4260033DE1CB42EF09A0" 6c291243393d267250d505ba4c27195a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BB3FE1D22DBD27FD0A48B7D9060" 6c291243393d267250d505ba4c27195a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" nszynhsmaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" nszynhsmaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs nszynhsmaf.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 6c291243393d267250d505ba4c27195a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33342D7B9D2382566A3276A777252CAC7D8F64DF" 6c291243393d267250d505ba4c27195a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193AC6081596DBB3B9C17FE5EC9634CF" 6c291243393d267250d505ba4c27195a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" nszynhsmaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B02A47E239EF52CDBAD0329CD7BE" 6c291243393d267250d505ba4c27195a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF9FCFB4827856D9145D65A7DE5BD93E13D594267426332D7ED" 6c291243393d267250d505ba4c27195a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh nszynhsmaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat nszynhsmaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf nszynhsmaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" nszynhsmaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg nszynhsmaf.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4236 WINWORD.EXE 4236 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 4904 cplmsbig.exe 4904 cplmsbig.exe 4904 cplmsbig.exe 4904 cplmsbig.exe 4904 cplmsbig.exe 4904 cplmsbig.exe 4904 cplmsbig.exe 4904 cplmsbig.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3680 xcjlvlluubxdeoz.exe 3888 cplmsbig.exe 3888 cplmsbig.exe 3888 cplmsbig.exe 3888 cplmsbig.exe 3888 cplmsbig.exe 3888 cplmsbig.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 4904 cplmsbig.exe 3680 xcjlvlluubxdeoz.exe 4904 cplmsbig.exe 3680 xcjlvlluubxdeoz.exe 4904 cplmsbig.exe 3680 xcjlvlluubxdeoz.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3888 cplmsbig.exe 3888 cplmsbig.exe 3888 cplmsbig.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 2088 6c291243393d267250d505ba4c27195a.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 380 nszynhsmaf.exe 4904 cplmsbig.exe 3680 xcjlvlluubxdeoz.exe 4904 cplmsbig.exe 3680 xcjlvlluubxdeoz.exe 4904 cplmsbig.exe 3680 xcjlvlluubxdeoz.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3660 xwgefrkeoeelb.exe 3888 cplmsbig.exe 3888 cplmsbig.exe 3888 cplmsbig.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4236 WINWORD.EXE 4236 WINWORD.EXE 4236 WINWORD.EXE 4236 WINWORD.EXE 4236 WINWORD.EXE 4236 WINWORD.EXE 4236 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2088 wrote to memory of 380 2088 6c291243393d267250d505ba4c27195a.exe 88 PID 2088 wrote to memory of 380 2088 6c291243393d267250d505ba4c27195a.exe 88 PID 2088 wrote to memory of 380 2088 6c291243393d267250d505ba4c27195a.exe 88 PID 2088 wrote to memory of 3680 2088 6c291243393d267250d505ba4c27195a.exe 91 PID 2088 wrote to memory of 3680 2088 6c291243393d267250d505ba4c27195a.exe 91 PID 2088 wrote to memory of 3680 2088 6c291243393d267250d505ba4c27195a.exe 91 PID 2088 wrote to memory of 4904 2088 6c291243393d267250d505ba4c27195a.exe 90 PID 2088 wrote to memory of 4904 2088 6c291243393d267250d505ba4c27195a.exe 90 PID 2088 wrote to memory of 4904 2088 6c291243393d267250d505ba4c27195a.exe 90 PID 2088 wrote to memory of 3660 2088 6c291243393d267250d505ba4c27195a.exe 89 PID 2088 wrote to memory of 3660 2088 6c291243393d267250d505ba4c27195a.exe 89 PID 2088 wrote to memory of 3660 2088 6c291243393d267250d505ba4c27195a.exe 89 PID 2088 wrote to memory of 4236 2088 6c291243393d267250d505ba4c27195a.exe 92 PID 2088 wrote to memory of 4236 2088 6c291243393d267250d505ba4c27195a.exe 92 PID 380 wrote to memory of 3888 380 nszynhsmaf.exe 98 PID 380 wrote to memory of 3888 380 nszynhsmaf.exe 98 PID 380 wrote to memory of 3888 380 nszynhsmaf.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c291243393d267250d505ba4c27195a.exe"C:\Users\Admin\AppData\Local\Temp\6c291243393d267250d505ba4c27195a.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\nszynhsmaf.exenszynhsmaf.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\cplmsbig.exeC:\Windows\system32\cplmsbig.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3888
-
-
-
C:\Windows\SysWOW64\xwgefrkeoeelb.exexwgefrkeoeelb.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3660
-
-
C:\Windows\SysWOW64\cplmsbig.execplmsbig.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4904
-
-
C:\Windows\SysWOW64\xcjlvlluubxdeoz.exexcjlvlluubxdeoz.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3680
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4236
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD572c717bda8d4788d97fdc2113ac32abf
SHA160746eb84f5c57cd6dd1b154c730e11064fc5364
SHA25666f715d2e6489426ddd3d4dfe65e97da80ea70dabf3320316b811c23ef130a54
SHA512c6c0c628e04d96e514cec0d9851e135993b9d92222f9e3aaad662be75a5d40faa0575d6400dc7e5a7ce92d97f3922e20eb2542f002a673ebe81d04c41e3d0ac7
-
Filesize
512KB
MD5a224961a4ed2cef5a984f4460eebd6f3
SHA146ebc5523d9718d250f7541ec88a5846f9b62f6c
SHA256b9e6dff7d4d57c56ebceb8d254aef2a8f218308823942b7b65501d0c77f4180f
SHA5122f19939825772f8099ab599d54ede0f23ba855e265fdd8adcfc30750ff19f12614aca1bdb852d7d425a1531fb5d3b05dd708f6b8e602039c431090a8a503c913
-
Filesize
512KB
MD57e5a4c24bcd3a6200b9e9b14732ec420
SHA11b4fe62d898ee81402682e1e37a17878af52dbb5
SHA256f45d1d736028ae954969fe89c97a46da6e1c8331a6dbc89e76efe1b631d0a527
SHA512a7b9608c8aea1eeaa6bbfef19056012af6d90cc937423a8098a487678a88471395ca801642eb4abb9942a071b076d69cf3763583c7bfda620b91f2732a6f21f0
-
Filesize
92KB
MD56662b185f19fbf697c56a25c92de7961
SHA10df0c0df0de3724258df2549c583e3c934aca726
SHA256c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86
SHA512c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f
-
Filesize
512KB
MD54d24539f4c10d4a7570fb757ad63c10b
SHA1b91a8376871618ea455f467dab7a8bda4629d3e8
SHA256768fad511a3555ce8678a6559e4a0fc1375318df9e314c3d3e433e1da30ca144
SHA5121f56ffc9fec19bf0e980bb91fa1e74b772f832c207a6515fb0ffc5f69ee31cdd0b4b0203560732d7eeeb7ff43a558badbfacddb262168037e24d7fdb25a1908b