Analysis
-
max time kernel
162s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-01-2024 12:33
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
43b1e4d14fbf528e5d467fab8c087b29.exe
Resource
win7-20231215-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
43b1e4d14fbf528e5d467fab8c087b29.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
43b1e4d14fbf528e5d467fab8c087b29.exe
-
Size
512KB
-
MD5
43b1e4d14fbf528e5d467fab8c087b29
-
SHA1
1cb1894a9bdac78f3016e3fcfb587836a7335053
-
SHA256
a82b27816e216a1989d545384074bf2e6cdbaf8a5d13268c697ef4134715242b
-
SHA512
d15cc6df8ce240e874d7f7ff6afba0217746c5b2394f419b723f6ff67b982f1d387714f99540e0dbb96958eac5a18dd2260dc0a8a4ef14d9ef83f922a1303863
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6x:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" htwzukatnd.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" htwzukatnd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" htwzukatnd.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" htwzukatnd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 43b1e4d14fbf528e5d467fab8c087b29.exe -
Executes dropped EXE 5 IoCs
pid Process 4904 htwzukatnd.exe 1300 yiqzcrizebpfppm.exe 2292 smwuagqq.exe 2280 ljrceagfyuyff.exe 3572 smwuagqq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" htwzukatnd.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gjgojsxq = "htwzukatnd.exe" yiqzcrizebpfppm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vzhjonkd = "yiqzcrizebpfppm.exe" yiqzcrizebpfppm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ljrceagfyuyff.exe" yiqzcrizebpfppm.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: smwuagqq.exe File opened (read-only) \??\p: smwuagqq.exe File opened (read-only) \??\w: smwuagqq.exe File opened (read-only) \??\g: smwuagqq.exe File opened (read-only) \??\h: smwuagqq.exe File opened (read-only) \??\i: smwuagqq.exe File opened (read-only) \??\n: smwuagqq.exe File opened (read-only) \??\n: smwuagqq.exe File opened (read-only) \??\x: htwzukatnd.exe File opened (read-only) \??\h: smwuagqq.exe File opened (read-only) \??\j: htwzukatnd.exe File opened (read-only) \??\q: htwzukatnd.exe File opened (read-only) \??\t: htwzukatnd.exe File opened (read-only) \??\z: htwzukatnd.exe File opened (read-only) \??\a: smwuagqq.exe File opened (read-only) \??\w: htwzukatnd.exe File opened (read-only) \??\y: htwzukatnd.exe File opened (read-only) \??\z: smwuagqq.exe File opened (read-only) \??\h: htwzukatnd.exe File opened (read-only) \??\i: smwuagqq.exe File opened (read-only) \??\j: smwuagqq.exe File opened (read-only) \??\l: smwuagqq.exe File opened (read-only) \??\o: smwuagqq.exe File opened (read-only) \??\b: htwzukatnd.exe File opened (read-only) \??\m: htwzukatnd.exe File opened (read-only) \??\p: htwzukatnd.exe File opened (read-only) \??\q: smwuagqq.exe File opened (read-only) \??\x: smwuagqq.exe File opened (read-only) \??\e: smwuagqq.exe File opened (read-only) \??\t: smwuagqq.exe File opened (read-only) \??\u: smwuagqq.exe File opened (read-only) \??\s: smwuagqq.exe File opened (read-only) \??\r: smwuagqq.exe File opened (read-only) \??\i: htwzukatnd.exe File opened (read-only) \??\a: smwuagqq.exe File opened (read-only) \??\l: smwuagqq.exe File opened (read-only) \??\y: smwuagqq.exe File opened (read-only) \??\b: smwuagqq.exe File opened (read-only) \??\a: htwzukatnd.exe File opened (read-only) \??\b: smwuagqq.exe File opened (read-only) \??\m: smwuagqq.exe File opened (read-only) \??\r: smwuagqq.exe File opened (read-only) \??\v: smwuagqq.exe File opened (read-only) \??\r: htwzukatnd.exe File opened (read-only) \??\g: smwuagqq.exe File opened (read-only) \??\k: smwuagqq.exe File opened (read-only) \??\y: smwuagqq.exe File opened (read-only) \??\z: smwuagqq.exe File opened (read-only) \??\l: htwzukatnd.exe File opened (read-only) \??\o: htwzukatnd.exe File opened (read-only) \??\s: htwzukatnd.exe File opened (read-only) \??\j: smwuagqq.exe File opened (read-only) \??\q: smwuagqq.exe File opened (read-only) \??\s: smwuagqq.exe File opened (read-only) \??\x: smwuagqq.exe File opened (read-only) \??\u: smwuagqq.exe File opened (read-only) \??\g: htwzukatnd.exe File opened (read-only) \??\v: htwzukatnd.exe File opened (read-only) \??\e: smwuagqq.exe File opened (read-only) \??\t: smwuagqq.exe File opened (read-only) \??\v: smwuagqq.exe File opened (read-only) \??\w: smwuagqq.exe File opened (read-only) \??\e: htwzukatnd.exe File opened (read-only) \??\k: htwzukatnd.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" htwzukatnd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" htwzukatnd.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1812-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000300000001e7e3-5.dat autoit_exe behavioral2/files/0x000300000001e7e1-18.dat autoit_exe behavioral2/files/0x000300000001e7e4-26.dat autoit_exe behavioral2/files/0x000400000001e7e5-32.dat autoit_exe behavioral2/files/0x000300000001e7f9-63.dat autoit_exe behavioral2/files/0x000300000001e7f5-54.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\yiqzcrizebpfppm.exe 43b1e4d14fbf528e5d467fab8c087b29.exe File created C:\Windows\SysWOW64\smwuagqq.exe 43b1e4d14fbf528e5d467fab8c087b29.exe File opened for modification C:\Windows\SysWOW64\ljrceagfyuyff.exe 43b1e4d14fbf528e5d467fab8c087b29.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll htwzukatnd.exe File created C:\Windows\SysWOW64\htwzukatnd.exe 43b1e4d14fbf528e5d467fab8c087b29.exe File opened for modification C:\Windows\SysWOW64\htwzukatnd.exe 43b1e4d14fbf528e5d467fab8c087b29.exe File opened for modification C:\Windows\SysWOW64\yiqzcrizebpfppm.exe 43b1e4d14fbf528e5d467fab8c087b29.exe File opened for modification C:\Windows\SysWOW64\smwuagqq.exe 43b1e4d14fbf528e5d467fab8c087b29.exe File created C:\Windows\SysWOW64\ljrceagfyuyff.exe 43b1e4d14fbf528e5d467fab8c087b29.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe smwuagqq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal smwuagqq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe smwuagqq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe smwuagqq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe smwuagqq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal smwuagqq.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe smwuagqq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe smwuagqq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal smwuagqq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe smwuagqq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe smwuagqq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe smwuagqq.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe smwuagqq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal smwuagqq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe smwuagqq.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 43b1e4d14fbf528e5d467fab8c087b29.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf htwzukatnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBCFABDFE17F29383083A4386EB3EE2B08A028F4268033FE2CE459908A7" 43b1e4d14fbf528e5d467fab8c087b29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" htwzukatnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" htwzukatnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" htwzukatnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" htwzukatnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB1B15C4490389853CFBAD533EDD4BC" 43b1e4d14fbf528e5d467fab8c087b29.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat htwzukatnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" htwzukatnd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg htwzukatnd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" htwzukatnd.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 43b1e4d14fbf528e5d467fab8c087b29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322D7C9D5582556D4276A270272DDA7D8064DD" 43b1e4d14fbf528e5d467fab8c087b29.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs htwzukatnd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh htwzukatnd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc htwzukatnd.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings 43b1e4d14fbf528e5d467fab8c087b29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFDFF8D4F5D8512913DD75F7D92BD92E6405842664E6341D7E9" 43b1e4d14fbf528e5d467fab8c087b29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F66BC6FE1A21AED27AD1D48B0E906B" 43b1e4d14fbf528e5d467fab8c087b29.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193DC77B1593DAB1B8CB7C93ED9534CD" 43b1e4d14fbf528e5d467fab8c087b29.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2548 WINWORD.EXE 2548 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 3572 smwuagqq.exe 3572 smwuagqq.exe 3572 smwuagqq.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 4904 htwzukatnd.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 1300 yiqzcrizebpfppm.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2292 smwuagqq.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 2280 ljrceagfyuyff.exe 3572 smwuagqq.exe 3572 smwuagqq.exe 3572 smwuagqq.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE 2548 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1812 wrote to memory of 4904 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 91 PID 1812 wrote to memory of 4904 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 91 PID 1812 wrote to memory of 4904 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 91 PID 1812 wrote to memory of 1300 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 92 PID 1812 wrote to memory of 1300 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 92 PID 1812 wrote to memory of 1300 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 92 PID 1812 wrote to memory of 2292 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 93 PID 1812 wrote to memory of 2292 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 93 PID 1812 wrote to memory of 2292 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 93 PID 1812 wrote to memory of 2280 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 94 PID 1812 wrote to memory of 2280 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 94 PID 1812 wrote to memory of 2280 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 94 PID 4904 wrote to memory of 3572 4904 htwzukatnd.exe 97 PID 4904 wrote to memory of 3572 4904 htwzukatnd.exe 97 PID 4904 wrote to memory of 3572 4904 htwzukatnd.exe 97 PID 1812 wrote to memory of 2548 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 99 PID 1812 wrote to memory of 2548 1812 43b1e4d14fbf528e5d467fab8c087b29.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\43b1e4d14fbf528e5d467fab8c087b29.exe"C:\Users\Admin\AppData\Local\Temp\43b1e4d14fbf528e5d467fab8c087b29.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\htwzukatnd.exehtwzukatnd.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\smwuagqq.exeC:\Windows\system32\smwuagqq.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3572
-
-
-
C:\Windows\SysWOW64\yiqzcrizebpfppm.exeyiqzcrizebpfppm.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1300
-
-
C:\Windows\SysWOW64\smwuagqq.exesmwuagqq.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2292
-
-
C:\Windows\SysWOW64\ljrceagfyuyff.exeljrceagfyuyff.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2280
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2548
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD54e4468f7c070814287d3fbc61f5f2563
SHA112377f7334c20629ca8a7fdb23670d64a6849635
SHA256b1a33eae54595ef4aa274c4ebe0372fa478cbe81878acd5f435c11a8eee05ef7
SHA512e50d0afa1e50478e4cabf562c887ee76cfad609b582f90de3666347ebf8f918052849aafe7c487ef61b2e9823cf8f002d77b6eaf63752a90e29a6aea4b2dd9c9
-
Filesize
512KB
MD542c0f3040d3ab04592365603338d029b
SHA12460157217da9a7544c8372562d5b67697a73986
SHA256c7361963fd2816d9cc2778f1ba1653f00dd4130547b2523053186d93197f9221
SHA5128a09abae3283a645541acf577960bc5c1ee49e0fcba69e3f33eecb16e61291fb42f4f3faa29b1693f0c388508a6ccb922dd935e1d553da9194e74f2542f5a5f9
-
Filesize
512KB
MD5c8d85c55c228619698951daf4758e9a7
SHA101c286bca93dcd8a0e94413d6cbd8086a3a63528
SHA256b63dffdec500e6fdd8142028785b1e8c4612aaf8c7ec1551c0aea32a4a7e9c22
SHA512bf5c5eeab1bcce2cfed80df213e376256e6dc1120f5dca138a070a9aee9f8d9d8e7e11b7f1d6c5b903c1ce619e5904e93fc4a0ed11fc03dcbcd74cdf4fa4f051
-
Filesize
512KB
MD5c600b509cc7192493ed8c8b0c2e37afa
SHA1a1492d64d09f25d632aea7201e51a9eeb5b363c5
SHA256abbe72591ba0a88c2e9ed6e099e7d62f7afb80a41fa42401425b6c6ef87ee6fa
SHA512901fa6b06260b86f57159b3b44b23fb9ad6742d4e7f7f0d21761a2555a57739d7f3682d2c59007fe8688a3bf3a2c01cb64875ac516efcc04b1bc05ecd527146c
-
Filesize
512KB
MD54c2d3292a8b0f8a1707fc60553f032c8
SHA1411b2458d18690bb81f669c6545a14d2c081b131
SHA2563a811489f5c7ad9243f7a80b7b40e56010e00ab1b1eb82dfeb66bee250e7a417
SHA5123696a2cb7305685880b6ffe8d296c7bbdbcb76395ef74351f99e49e2b44c57d7d573bcb3bad1e8b2626cbdd35fc47e2fd9aff971bdee9ce978afa6b30a63bc6d
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD548d20a011d01c3b4409eb16759c8a2e2
SHA12c918d4662c5c93c8d8ef874e10f4005b5eb701c
SHA25682b131cfb4d8089c0f7f65ce889c32695944df0fae10b9db3e6791ec98c5e444
SHA512bf22b546c92f66d597235695ab477188b1d1d767d01912157504b71c611922e097a063c3d9c3e1e186d73050bdc934305b3a4939ff62b9efca9746dc67b76409