Analysis
-
max time kernel
169s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31-12-2023 16:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3a8927099672a7939b9bd8e2faab0a0b.exe
Resource
win7-20231215-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
3a8927099672a7939b9bd8e2faab0a0b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
3a8927099672a7939b9bd8e2faab0a0b.exe
-
Size
512KB
-
MD5
3a8927099672a7939b9bd8e2faab0a0b
-
SHA1
408ef73dfe2fb22405184de9ef03a7978ca43318
-
SHA256
de7e76ca5c9a4d81b74ed3bf6482913e45d3e9f0c71206afbb4d8b87a37800f7
-
SHA512
553e6ed32c723eb423b4d72e89be158e420854cccaa6282c7414853f9e220a501fe3998fbca5e75e2f0860e60afbf9d3f0e0cccee0a9ae82e1607adbe9cae8c1
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" wbifkiouyq.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wbifkiouyq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wbifkiouyq.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wbifkiouyq.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 3a8927099672a7939b9bd8e2faab0a0b.exe -
Executes dropped EXE 5 IoCs
pid Process 3872 wbifkiouyq.exe 2852 dwnwvmkxfbdccpb.exe 3824 mlcpmqcf.exe 3528 wnizchglewvxv.exe 564 mlcpmqcf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wbifkiouyq.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\inmvqcmb = "wbifkiouyq.exe" dwnwvmkxfbdccpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hjwwtpjk = "dwnwvmkxfbdccpb.exe" dwnwvmkxfbdccpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "wnizchglewvxv.exe" dwnwvmkxfbdccpb.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: mlcpmqcf.exe File opened (read-only) \??\j: mlcpmqcf.exe File opened (read-only) \??\x: mlcpmqcf.exe File opened (read-only) \??\m: wbifkiouyq.exe File opened (read-only) \??\h: wbifkiouyq.exe File opened (read-only) \??\r: wbifkiouyq.exe File opened (read-only) \??\v: mlcpmqcf.exe File opened (read-only) \??\k: mlcpmqcf.exe File opened (read-only) \??\a: mlcpmqcf.exe File opened (read-only) \??\b: mlcpmqcf.exe File opened (read-only) \??\u: mlcpmqcf.exe File opened (read-only) \??\y: mlcpmqcf.exe File opened (read-only) \??\o: mlcpmqcf.exe File opened (read-only) \??\s: mlcpmqcf.exe File opened (read-only) \??\q: mlcpmqcf.exe File opened (read-only) \??\l: mlcpmqcf.exe File opened (read-only) \??\n: mlcpmqcf.exe File opened (read-only) \??\p: mlcpmqcf.exe File opened (read-only) \??\t: mlcpmqcf.exe File opened (read-only) \??\b: wbifkiouyq.exe File opened (read-only) \??\i: wbifkiouyq.exe File opened (read-only) \??\x: wbifkiouyq.exe File opened (read-only) \??\u: mlcpmqcf.exe File opened (read-only) \??\a: wbifkiouyq.exe File opened (read-only) \??\n: wbifkiouyq.exe File opened (read-only) \??\z: mlcpmqcf.exe File opened (read-only) \??\j: wbifkiouyq.exe File opened (read-only) \??\q: wbifkiouyq.exe File opened (read-only) \??\g: mlcpmqcf.exe File opened (read-only) \??\p: mlcpmqcf.exe File opened (read-only) \??\y: wbifkiouyq.exe File opened (read-only) \??\a: mlcpmqcf.exe File opened (read-only) \??\m: mlcpmqcf.exe File opened (read-only) \??\v: mlcpmqcf.exe File opened (read-only) \??\k: wbifkiouyq.exe File opened (read-only) \??\o: wbifkiouyq.exe File opened (read-only) \??\t: wbifkiouyq.exe File opened (read-only) \??\u: wbifkiouyq.exe File opened (read-only) \??\k: mlcpmqcf.exe File opened (read-only) \??\l: mlcpmqcf.exe File opened (read-only) \??\r: mlcpmqcf.exe File opened (read-only) \??\l: wbifkiouyq.exe File opened (read-only) \??\n: mlcpmqcf.exe File opened (read-only) \??\i: mlcpmqcf.exe File opened (read-only) \??\y: mlcpmqcf.exe File opened (read-only) \??\p: wbifkiouyq.exe File opened (read-only) \??\s: wbifkiouyq.exe File opened (read-only) \??\i: mlcpmqcf.exe File opened (read-only) \??\j: mlcpmqcf.exe File opened (read-only) \??\h: mlcpmqcf.exe File opened (read-only) \??\e: wbifkiouyq.exe File opened (read-only) \??\w: wbifkiouyq.exe File opened (read-only) \??\z: wbifkiouyq.exe File opened (read-only) \??\s: mlcpmqcf.exe File opened (read-only) \??\r: mlcpmqcf.exe File opened (read-only) \??\v: wbifkiouyq.exe File opened (read-only) \??\b: mlcpmqcf.exe File opened (read-only) \??\z: mlcpmqcf.exe File opened (read-only) \??\e: mlcpmqcf.exe File opened (read-only) \??\h: mlcpmqcf.exe File opened (read-only) \??\t: mlcpmqcf.exe File opened (read-only) \??\q: mlcpmqcf.exe File opened (read-only) \??\w: mlcpmqcf.exe File opened (read-only) \??\o: mlcpmqcf.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" wbifkiouyq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" wbifkiouyq.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4608-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000300000001e7e5-5.dat autoit_exe behavioral2/files/0x000300000001e7e4-18.dat autoit_exe behavioral2/files/0x000300000001e7e7-30.dat autoit_exe behavioral2/files/0x000300000001e7e6-29.dat autoit_exe behavioral2/files/0x000200000001e7ff-76.dat autoit_exe behavioral2/files/0x000200000001e803-84.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mlcpmqcf.exe 3a8927099672a7939b9bd8e2faab0a0b.exe File created C:\Windows\SysWOW64\wnizchglewvxv.exe 3a8927099672a7939b9bd8e2faab0a0b.exe File created C:\Windows\SysWOW64\wbifkiouyq.exe 3a8927099672a7939b9bd8e2faab0a0b.exe File opened for modification C:\Windows\SysWOW64\wbifkiouyq.exe 3a8927099672a7939b9bd8e2faab0a0b.exe File opened for modification C:\Windows\SysWOW64\dwnwvmkxfbdccpb.exe 3a8927099672a7939b9bd8e2faab0a0b.exe File created C:\Windows\SysWOW64\mlcpmqcf.exe 3a8927099672a7939b9bd8e2faab0a0b.exe File created C:\Windows\SysWOW64\dwnwvmkxfbdccpb.exe 3a8927099672a7939b9bd8e2faab0a0b.exe File opened for modification C:\Windows\SysWOW64\wnizchglewvxv.exe 3a8927099672a7939b9bd8e2faab0a0b.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll wbifkiouyq.exe -
Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mlcpmqcf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mlcpmqcf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mlcpmqcf.exe File opened for modification C:\Program Files\OpenReset.nal mlcpmqcf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mlcpmqcf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mlcpmqcf.exe File opened for modification \??\c:\Program Files\OpenReset.doc.exe mlcpmqcf.exe File opened for modification C:\Program Files\OpenReset.nal mlcpmqcf.exe File opened for modification C:\Program Files\OpenReset.doc.exe mlcpmqcf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mlcpmqcf.exe File opened for modification C:\Program Files\OpenReset.doc.exe mlcpmqcf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mlcpmqcf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal mlcpmqcf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mlcpmqcf.exe File opened for modification \??\c:\Program Files\OpenReset.doc.exe mlcpmqcf.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mlcpmqcf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mlcpmqcf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe mlcpmqcf.exe File created \??\c:\Program Files\OpenReset.doc.exe mlcpmqcf.exe File created \??\c:\Program Files\OpenReset.doc.exe mlcpmqcf.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe mlcpmqcf.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal mlcpmqcf.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 3a8927099672a7939b9bd8e2faab0a0b.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 3a8927099672a7939b9bd8e2faab0a0b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC8F9CAF963F2E7840F3B3586E93E99B089028F4313033AE1CD459908A8" 3a8927099672a7939b9bd8e2faab0a0b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" wbifkiouyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" wbifkiouyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" wbifkiouyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg wbifkiouyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" wbifkiouyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32442C7A9C2083596A3776A070522DDB7C8765D8" 3a8927099672a7939b9bd8e2faab0a0b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC6B15F479438E253BAB9D332EFD7B9" 3a8927099672a7939b9bd8e2faab0a0b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat wbifkiouyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" wbifkiouyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" wbifkiouyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf wbifkiouyq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8FFF894829821B9142D72F7D92BDE1E137584066416236D6E9" 3a8927099672a7939b9bd8e2faab0a0b.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings 3a8927099672a7939b9bd8e2faab0a0b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7816BC2FE6922DED108D0D48A749113" 3a8927099672a7939b9bd8e2faab0a0b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C67B14E5DBC7B9C07FE4ED9434BB" 3a8927099672a7939b9bd8e2faab0a0b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh wbifkiouyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc wbifkiouyq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs wbifkiouyq.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 848 WINWORD.EXE 848 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3824 mlcpmqcf.exe 3824 mlcpmqcf.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3824 mlcpmqcf.exe 3824 mlcpmqcf.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3824 mlcpmqcf.exe 3824 mlcpmqcf.exe 3824 mlcpmqcf.exe 3824 mlcpmqcf.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 3528 wnizchglewvxv.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe -
Suspicious use of FindShellTrayWindow 19 IoCs
pid Process 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 3528 wnizchglewvxv.exe 3824 mlcpmqcf.exe 3528 wnizchglewvxv.exe 3824 mlcpmqcf.exe 3528 wnizchglewvxv.exe 3824 mlcpmqcf.exe 564 mlcpmqcf.exe 564 mlcpmqcf.exe 564 mlcpmqcf.exe -
Suspicious use of SendNotifyMessage 19 IoCs
pid Process 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 3872 wbifkiouyq.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 2852 dwnwvmkxfbdccpb.exe 3528 wnizchglewvxv.exe 3824 mlcpmqcf.exe 3528 wnizchglewvxv.exe 3824 mlcpmqcf.exe 3528 wnizchglewvxv.exe 3824 mlcpmqcf.exe 564 mlcpmqcf.exe 564 mlcpmqcf.exe 564 mlcpmqcf.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4608 wrote to memory of 3872 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 93 PID 4608 wrote to memory of 3872 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 93 PID 4608 wrote to memory of 3872 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 93 PID 4608 wrote to memory of 2852 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 94 PID 4608 wrote to memory of 2852 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 94 PID 4608 wrote to memory of 2852 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 94 PID 4608 wrote to memory of 3824 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 96 PID 4608 wrote to memory of 3824 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 96 PID 4608 wrote to memory of 3824 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 96 PID 4608 wrote to memory of 3528 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 95 PID 4608 wrote to memory of 3528 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 95 PID 4608 wrote to memory of 3528 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 95 PID 3872 wrote to memory of 564 3872 wbifkiouyq.exe 98 PID 3872 wrote to memory of 564 3872 wbifkiouyq.exe 98 PID 3872 wrote to memory of 564 3872 wbifkiouyq.exe 98 PID 4608 wrote to memory of 848 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 100 PID 4608 wrote to memory of 848 4608 3a8927099672a7939b9bd8e2faab0a0b.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a8927099672a7939b9bd8e2faab0a0b.exe"C:\Users\Admin\AppData\Local\Temp\3a8927099672a7939b9bd8e2faab0a0b.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\wbifkiouyq.exewbifkiouyq.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\mlcpmqcf.exeC:\Windows\system32\mlcpmqcf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:564
-
-
-
C:\Windows\SysWOW64\dwnwvmkxfbdccpb.exedwnwvmkxfbdccpb.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2852
-
-
C:\Windows\SysWOW64\wnizchglewvxv.exewnizchglewvxv.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3528
-
-
C:\Windows\SysWOW64\mlcpmqcf.exemlcpmqcf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3824
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:848
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD592d47d50745f95b70573f0f4a153006f
SHA184eeae7e495b5972e2c2b66db551cf473459e4a0
SHA256c0cc9f99252f6081ce3ab476199ec681ff363291426cf73f1e9111aabee832ba
SHA51242708a4b85d041eb59badb87f90b10727d9a092270fe8e8a43b0da447dad7b8048936fdd2c6b15b3c13655935d981d1421f0a215823af29606ba7f87184f7ef8
-
Filesize
512KB
MD553ea914e51d76259c61da84f0be48c3e
SHA17b429ca3198a2e45e8f357a25f320d88ca87ccc1
SHA2562daa481369e1b89a5a1e796f9ab5ac198c8a49fa669ebcabbb3c8d45a6c207b4
SHA5126f7638ab72a4e38650172976e84aef117be5adee893adeb2a46c0bf3b5ae97f5d382a860845d5f926a8a31bfae06be724997f11f6032142258d649a6a3e2268c
-
Filesize
512KB
MD5abea66785e6eedb7e80eb3019521d09c
SHA1ace3a5a9635f17819d40a389e7b68c7852272701
SHA2560a7cf87e79bf1eda5f2cfcf951714f1b7fbd79b35aec14f6f835dcc13a3ccdc3
SHA51253afc1c67ceefefbf3e82bbf4dea3f17dd2a9383b1cf7686bde25146d0e8419aa0b294d143c883fd2b5eb3c4e953b06f12cedca06b5f2a46684d87c49d9f7e4e
-
Filesize
512KB
MD5004a035681c14732f6c46d78a6307e46
SHA1167cc9371274d3975b48f576fa438268e774f797
SHA2566029634a56b2ea17b10464e2c5895142c887a042ed5b8af510006723ec6ebde9
SHA5126a48ba5ecb1180dd59f0bd90181d6a94ffed3c8331e5f9f09068370378dbb0ed90c71e8df9b53a04645edbe7e6b5e08a9c31af9b79ed8b9df322e37f6c78e7ae
-
Filesize
512KB
MD5aa9126179a1f5a5f41862b3964dd459d
SHA164d5e576b11676a4414033015ed289b4b2c2ed72
SHA2562155bb4b90d674a7a47b1b048a95a0c3d1c3088938476d6abfe9e2d10d9a3b0f
SHA5125b826ca96627f356993ab8c368afc42617a69442bab32f01bbbf76be422eccf1651a6b8f75e67711faa89cc0b10309d80ba54dc7a4eb3c24a134a0c9600242aa
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5291fe0ebcc5ae8f9fef973b2e4a7a879
SHA186cafe7a6af73422af296f39319abec60767ecca
SHA2568929d7da1c8d7850948bd3ef901d3ace43cacfa3a1e1e5aa907bf730cc24d5a7
SHA5124ac5d2ec22300c8a0b9c1c8a65adfae91b481f683ada94b9f59f4e3c1724eb935a6651b47aca475e5d9af89724397e5847133e0383529f9a8f5bb7b778fd59ea