Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 04:52
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
0f204124cb067932ab90bb44f2fdb666.exe
Resource
win7-20231215-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f204124cb067932ab90bb44f2fdb666.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
0f204124cb067932ab90bb44f2fdb666.exe
-
Size
512KB
-
MD5
0f204124cb067932ab90bb44f2fdb666
-
SHA1
b944d80fef69756ef58631ca18a9f0ffb14a900f
-
SHA256
fc5b5a8e273e96cc708a8df86e3a3e4ae0ae79ffae82877a0b3991c919c29e30
-
SHA512
e7771c49e264ec08d942dd29cbbb150b83969f1bfef9c50bc5c3452652cc20c364b005cb194d9336b66436e1a738c9af34ea3bee8af1ae55d9cd0b3eafa4f9c7
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ixjepulpus.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ixjepulpus.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ixjepulpus.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ixjepulpus.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 0f204124cb067932ab90bb44f2fdb666.exe -
Executes dropped EXE 5 IoCs
pid Process 2052 ixjepulpus.exe 868 lgwhqaiswaohljn.exe 4804 vaffxswd.exe 1664 mjbmwnuzhknkj.exe 2664 vaffxswd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ixjepulpus.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tyhsclkg = "lgwhqaiswaohljn.exe" lgwhqaiswaohljn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mjbmwnuzhknkj.exe" lgwhqaiswaohljn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\geezwwwb = "ixjepulpus.exe" lgwhqaiswaohljn.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: ixjepulpus.exe File opened (read-only) \??\r: vaffxswd.exe File opened (read-only) \??\h: vaffxswd.exe File opened (read-only) \??\j: vaffxswd.exe File opened (read-only) \??\z: vaffxswd.exe File opened (read-only) \??\g: vaffxswd.exe File opened (read-only) \??\s: vaffxswd.exe File opened (read-only) \??\e: ixjepulpus.exe File opened (read-only) \??\g: ixjepulpus.exe File opened (read-only) \??\m: ixjepulpus.exe File opened (read-only) \??\s: ixjepulpus.exe File opened (read-only) \??\l: vaffxswd.exe File opened (read-only) \??\p: vaffxswd.exe File opened (read-only) \??\o: vaffxswd.exe File opened (read-only) \??\r: vaffxswd.exe File opened (read-only) \??\l: ixjepulpus.exe File opened (read-only) \??\r: ixjepulpus.exe File opened (read-only) \??\u: ixjepulpus.exe File opened (read-only) \??\w: ixjepulpus.exe File opened (read-only) \??\e: vaffxswd.exe File opened (read-only) \??\k: vaffxswd.exe File opened (read-only) \??\y: vaffxswd.exe File opened (read-only) \??\n: ixjepulpus.exe File opened (read-only) \??\b: vaffxswd.exe File opened (read-only) \??\a: vaffxswd.exe File opened (read-only) \??\p: vaffxswd.exe File opened (read-only) \??\t: ixjepulpus.exe File opened (read-only) \??\v: ixjepulpus.exe File opened (read-only) \??\v: vaffxswd.exe File opened (read-only) \??\z: vaffxswd.exe File opened (read-only) \??\h: vaffxswd.exe File opened (read-only) \??\i: vaffxswd.exe File opened (read-only) \??\s: vaffxswd.exe File opened (read-only) \??\o: ixjepulpus.exe File opened (read-only) \??\x: ixjepulpus.exe File opened (read-only) \??\j: vaffxswd.exe File opened (read-only) \??\q: vaffxswd.exe File opened (read-only) \??\u: vaffxswd.exe File opened (read-only) \??\e: vaffxswd.exe File opened (read-only) \??\n: vaffxswd.exe File opened (read-only) \??\z: ixjepulpus.exe File opened (read-only) \??\n: vaffxswd.exe File opened (read-only) \??\t: vaffxswd.exe File opened (read-only) \??\u: vaffxswd.exe File opened (read-only) \??\k: vaffxswd.exe File opened (read-only) \??\m: vaffxswd.exe File opened (read-only) \??\y: vaffxswd.exe File opened (read-only) \??\w: vaffxswd.exe File opened (read-only) \??\h: ixjepulpus.exe File opened (read-only) \??\q: ixjepulpus.exe File opened (read-only) \??\a: vaffxswd.exe File opened (read-only) \??\w: vaffxswd.exe File opened (read-only) \??\a: ixjepulpus.exe File opened (read-only) \??\k: ixjepulpus.exe File opened (read-only) \??\q: vaffxswd.exe File opened (read-only) \??\p: ixjepulpus.exe File opened (read-only) \??\x: vaffxswd.exe File opened (read-only) \??\g: vaffxswd.exe File opened (read-only) \??\l: vaffxswd.exe File opened (read-only) \??\j: ixjepulpus.exe File opened (read-only) \??\v: vaffxswd.exe File opened (read-only) \??\m: vaffxswd.exe File opened (read-only) \??\x: vaffxswd.exe File opened (read-only) \??\t: vaffxswd.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ixjepulpus.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ixjepulpus.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4696-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00060000000231fd-32.dat autoit_exe behavioral2/files/0x00070000000231f8-24.dat autoit_exe behavioral2/files/0x00060000000231fc-29.dat autoit_exe behavioral2/files/0x00080000000231e6-19.dat autoit_exe behavioral2/files/0x000a0000000231d5-113.dat autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe vaffxswd.exe File created C:\Windows\SysWOW64\lgwhqaiswaohljn.exe 0f204124cb067932ab90bb44f2fdb666.exe File opened for modification C:\Windows\SysWOW64\lgwhqaiswaohljn.exe 0f204124cb067932ab90bb44f2fdb666.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe vaffxswd.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe vaffxswd.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe vaffxswd.exe File created C:\Windows\SysWOW64\vaffxswd.exe 0f204124cb067932ab90bb44f2fdb666.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ixjepulpus.exe File opened for modification C:\Windows\SysWOW64\ixjepulpus.exe 0f204124cb067932ab90bb44f2fdb666.exe File opened for modification C:\Windows\SysWOW64\mjbmwnuzhknkj.exe 0f204124cb067932ab90bb44f2fdb666.exe File created C:\Windows\SysWOW64\mjbmwnuzhknkj.exe 0f204124cb067932ab90bb44f2fdb666.exe File created C:\Windows\SysWOW64\ixjepulpus.exe 0f204124cb067932ab90bb44f2fdb666.exe File opened for modification C:\Windows\SysWOW64\vaffxswd.exe 0f204124cb067932ab90bb44f2fdb666.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vaffxswd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vaffxswd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vaffxswd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vaffxswd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vaffxswd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vaffxswd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vaffxswd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal vaffxswd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vaffxswd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe vaffxswd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal vaffxswd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal vaffxswd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal vaffxswd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe vaffxswd.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe vaffxswd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe vaffxswd.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe vaffxswd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe vaffxswd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe vaffxswd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe vaffxswd.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe vaffxswd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe vaffxswd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe vaffxswd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe vaffxswd.exe File opened for modification C:\Windows\mydoc.rtf 0f204124cb067932ab90bb44f2fdb666.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe vaffxswd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe vaffxswd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe vaffxswd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe vaffxswd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe vaffxswd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe vaffxswd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB9FACAFE6AF191840E3B4086EB3E92B388028A43670348E1B942EA08A4" 0f204124cb067932ab90bb44f2fdb666.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1944C7781593DBC3B8BE7CE8ED9534CE" 0f204124cb067932ab90bb44f2fdb666.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ixjepulpus.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ixjepulpus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ixjepulpus.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ixjepulpus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33352D0B9C2383236D4577D570532DDE7CF465DA" 0f204124cb067932ab90bb44f2fdb666.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFF8D485D851C9046D7297E90BCE7E143593567326335D79E" 0f204124cb067932ab90bb44f2fdb666.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings 0f204124cb067932ab90bb44f2fdb666.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ixjepulpus.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ixjepulpus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ixjepulpus.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ixjepulpus.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ixjepulpus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ixjepulpus.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 0f204124cb067932ab90bb44f2fdb666.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B12B4793399D52BDB9D13392D7BB" 0f204124cb067932ab90bb44f2fdb666.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F66BB0FE1822A9D10ED1A98B7E9113" 0f204124cb067932ab90bb44f2fdb666.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ixjepulpus.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ixjepulpus.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4308 WINWORD.EXE 4308 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 868 lgwhqaiswaohljn.exe 868 lgwhqaiswaohljn.exe 868 lgwhqaiswaohljn.exe 868 lgwhqaiswaohljn.exe 868 lgwhqaiswaohljn.exe 868 lgwhqaiswaohljn.exe 868 lgwhqaiswaohljn.exe 868 lgwhqaiswaohljn.exe 4804 vaffxswd.exe 4804 vaffxswd.exe 4804 vaffxswd.exe 4804 vaffxswd.exe 4804 vaffxswd.exe 4804 vaffxswd.exe 4804 vaffxswd.exe 4804 vaffxswd.exe 868 lgwhqaiswaohljn.exe 868 lgwhqaiswaohljn.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 1664 mjbmwnuzhknkj.exe 2052 ixjepulpus.exe 2052 ixjepulpus.exe 2052 ixjepulpus.exe 2052 ixjepulpus.exe 2052 ixjepulpus.exe 2052 ixjepulpus.exe 2052 ixjepulpus.exe 2052 ixjepulpus.exe 2052 ixjepulpus.exe 2052 ixjepulpus.exe 868 lgwhqaiswaohljn.exe 868 lgwhqaiswaohljn.exe 2664 vaffxswd.exe 2664 vaffxswd.exe 2664 vaffxswd.exe 2664 vaffxswd.exe 2664 vaffxswd.exe 2664 vaffxswd.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 868 lgwhqaiswaohljn.exe 4804 vaffxswd.exe 868 lgwhqaiswaohljn.exe 4804 vaffxswd.exe 868 lgwhqaiswaohljn.exe 4804 vaffxswd.exe 1664 mjbmwnuzhknkj.exe 2052 ixjepulpus.exe 1664 mjbmwnuzhknkj.exe 2052 ixjepulpus.exe 1664 mjbmwnuzhknkj.exe 2052 ixjepulpus.exe 2664 vaffxswd.exe 2664 vaffxswd.exe 2664 vaffxswd.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 4696 0f204124cb067932ab90bb44f2fdb666.exe 868 lgwhqaiswaohljn.exe 4804 vaffxswd.exe 868 lgwhqaiswaohljn.exe 4804 vaffxswd.exe 868 lgwhqaiswaohljn.exe 4804 vaffxswd.exe 1664 mjbmwnuzhknkj.exe 2052 ixjepulpus.exe 1664 mjbmwnuzhknkj.exe 2052 ixjepulpus.exe 1664 mjbmwnuzhknkj.exe 2052 ixjepulpus.exe 2664 vaffxswd.exe 2664 vaffxswd.exe 2664 vaffxswd.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE 4308 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4696 wrote to memory of 2052 4696 0f204124cb067932ab90bb44f2fdb666.exe 88 PID 4696 wrote to memory of 2052 4696 0f204124cb067932ab90bb44f2fdb666.exe 88 PID 4696 wrote to memory of 2052 4696 0f204124cb067932ab90bb44f2fdb666.exe 88 PID 4696 wrote to memory of 868 4696 0f204124cb067932ab90bb44f2fdb666.exe 95 PID 4696 wrote to memory of 868 4696 0f204124cb067932ab90bb44f2fdb666.exe 95 PID 4696 wrote to memory of 868 4696 0f204124cb067932ab90bb44f2fdb666.exe 95 PID 4696 wrote to memory of 4804 4696 0f204124cb067932ab90bb44f2fdb666.exe 94 PID 4696 wrote to memory of 4804 4696 0f204124cb067932ab90bb44f2fdb666.exe 94 PID 4696 wrote to memory of 4804 4696 0f204124cb067932ab90bb44f2fdb666.exe 94 PID 4696 wrote to memory of 1664 4696 0f204124cb067932ab90bb44f2fdb666.exe 89 PID 4696 wrote to memory of 1664 4696 0f204124cb067932ab90bb44f2fdb666.exe 89 PID 4696 wrote to memory of 1664 4696 0f204124cb067932ab90bb44f2fdb666.exe 89 PID 4696 wrote to memory of 4308 4696 0f204124cb067932ab90bb44f2fdb666.exe 90 PID 4696 wrote to memory of 4308 4696 0f204124cb067932ab90bb44f2fdb666.exe 90 PID 2052 wrote to memory of 2664 2052 ixjepulpus.exe 93 PID 2052 wrote to memory of 2664 2052 ixjepulpus.exe 93 PID 2052 wrote to memory of 2664 2052 ixjepulpus.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f204124cb067932ab90bb44f2fdb666.exe"C:\Users\Admin\AppData\Local\Temp\0f204124cb067932ab90bb44f2fdb666.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\ixjepulpus.exeixjepulpus.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\vaffxswd.exeC:\Windows\system32\vaffxswd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2664
-
-
-
C:\Windows\SysWOW64\mjbmwnuzhknkj.exemjbmwnuzhknkj.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1664
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4308
-
-
C:\Windows\SysWOW64\vaffxswd.exevaffxswd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4804
-
-
C:\Windows\SysWOW64\lgwhqaiswaohljn.exelgwhqaiswaohljn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:868
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD50c95f916e32ea0ea24bdc01c664d3d93
SHA1e59a7c92bb6cfbdcbe2e0e12b04685eb6fbbcd8d
SHA256fea9a50663fc25af1b49f66a5f9f028ffd327e1206ff9257c5f535d7d04a39e9
SHA512f75716b811805fb763ccf1d6e4a5faf0b1c4f26a000bf05657d6ba11970132aaae7bb649f3ea2d12bd9eb864dae7eabfb3edef03a71e819233129241945b92e5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD58c49d2e949a4d5de7b69e63cccb79d13
SHA108038b2a2395639a92ff6aa0b487e8628d76a135
SHA256a2202217cecd6655d7f0250ce3f17e85f01472ad6914e6a6aee03dbdbd8dad05
SHA5123c2a3baf001507721ebb0d59dd6d2ceab90f3801ca03726462fe2543064aca3f277a1cc4f6733e2df0499a35e9b1e558dc3645bc15be206b2e87b3386c471fcd
-
Filesize
512KB
MD5ffe210672101470782a8a5fa48af96c5
SHA1d68048c3dc9d17e35dc012bc9abcbde6eb40e33e
SHA2561b19ded236bacac75635a4a44d4eb8bfe861eb1e29e291dbae4421d6f65fda36
SHA512b12de3b40609b2cd978f6062d267ed86813aafa24f7c3a6857af37f9d41aee1033a07165d59f1915abc30ee6f8a4350eaf240f6f77042c686cdac7ff4d094e9b
-
Filesize
512KB
MD56c622c2728245936c002d06c5f8b70bf
SHA1bd0668e9cea146c29a43dfb5b2b0b97bfccc0404
SHA256991caed3619e7faaa9807839512441ba53cfd64fa2c44cbb9de8ce40d97630aa
SHA51289bf0b8b0c72a0c260cc80e91df0c25561e0392b340d1d5596f1ff02994a1f3d6aeb022707828ce0d3451b04c68224801c8f42dcaf721934a6d9995919c3662e
-
Filesize
512KB
MD56885dc78fb607e2caffa1a634740f9fc
SHA13b089108634941d1f0836aa8e0a64846646be5de
SHA25636bf2c8826b4a7a583737da435b834c3764d91b8333d489ed6e8861ae4687dec
SHA512fa3150f29a45f4af08cd1cdc3cf3b04a21eb3e7c17eb65a2cdf0c338ff3477a232ac95b5f9084c22ac604905a15087b3b9a2347030ba0e7acf4b7f5f202a12b0
-
Filesize
512KB
MD5d568f3ae9e9d462068012a832cdc51a5
SHA123befe7d4e6dc3f3cc7f5f8899c74608a835dd0d
SHA256de1546623514ee44b368b69091e8ccded324df2fbc458fc627b2f06ade731ac4
SHA51284d7d57aa77ce6c47bc4378518cef98f3a20289173cf19f9bc2112a2d26d522c267ba1f568938c4df8ed9f5b065bee67b76d2fa5cf90f0bd8954c68b06368305
-
Filesize
512KB
MD513209753fb3d981fde5bab51a513b064
SHA1235d928bf40a67d67db1f6185408e3247c365da7
SHA2565dad5d3c163f2eb4c525cd0ab087b315512c27e40838eed96fdf10baa1273322
SHA512902f04959696fc8bea57d15f6ec0b0dc9dc8a54d9d979fb139c19e81b882c26848430875dc66e2307692b037962f3704efc901879e3569df9217f1603b4c1d93