Analysis
-
max time kernel
0s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 10:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
460065e20051bbf96161a9b3a59ce1b6.exe
Resource
win7-20231215-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
460065e20051bbf96161a9b3a59ce1b6.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
460065e20051bbf96161a9b3a59ce1b6.exe
-
Size
512KB
-
MD5
460065e20051bbf96161a9b3a59ce1b6
-
SHA1
d2d6b8bdfe855b87f816d6c77783552228370ad6
-
SHA256
e3f047c98e3d6f7d29e4da35c4a814b999b423243a50da515c832b16273a8c78
-
SHA512
6865777d53b923b4a4922eb79872253fd691517f427b9eac9ae0e5fc772456800dcc3e8b3146b4d423693acee6ed0e0bc10581c16ab9bfd6facbb7517032fd08
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5f
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tqnerdtxhm.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tqnerdtxhm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" tqnerdtxhm.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tqnerdtxhm.exe -
Executes dropped EXE 4 IoCs
pid Process 2712 tqnerdtxhm.exe 2800 xamzeokkthkybfq.exe 2796 uaipqtpo.exe 2020 fzdvvdqbhcmhi.exe -
Loads dropped DLL 4 IoCs
pid Process 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tqnerdtxhm.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: uaipqtpo.exe File opened (read-only) \??\b: uaipqtpo.exe File opened (read-only) \??\e: uaipqtpo.exe File opened (read-only) \??\h: uaipqtpo.exe File opened (read-only) \??\k: uaipqtpo.exe File opened (read-only) \??\q: uaipqtpo.exe File opened (read-only) \??\t: uaipqtpo.exe File opened (read-only) \??\w: uaipqtpo.exe File opened (read-only) \??\y: uaipqtpo.exe File opened (read-only) \??\a: uaipqtpo.exe File opened (read-only) \??\g: uaipqtpo.exe File opened (read-only) \??\j: uaipqtpo.exe File opened (read-only) \??\p: uaipqtpo.exe File opened (read-only) \??\r: uaipqtpo.exe File opened (read-only) \??\n: uaipqtpo.exe File opened (read-only) \??\o: uaipqtpo.exe File opened (read-only) \??\s: uaipqtpo.exe File opened (read-only) \??\u: uaipqtpo.exe File opened (read-only) \??\v: uaipqtpo.exe File opened (read-only) \??\z: uaipqtpo.exe File opened (read-only) \??\i: uaipqtpo.exe File opened (read-only) \??\l: uaipqtpo.exe File opened (read-only) \??\m: uaipqtpo.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" tqnerdtxhm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" tqnerdtxhm.exe -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1960-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000d00000001232d-21.dat autoit_exe behavioral1/files/0x000d00000001232d-25.dat autoit_exe behavioral1/files/0x000d00000001224d-17.dat autoit_exe behavioral1/files/0x000d00000001232d-5.dat autoit_exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tqnerdtxhm.exe 460065e20051bbf96161a9b3a59ce1b6.exe File created C:\Windows\SysWOW64\xamzeokkthkybfq.exe 460065e20051bbf96161a9b3a59ce1b6.exe File opened for modification C:\Windows\SysWOW64\xamzeokkthkybfq.exe 460065e20051bbf96161a9b3a59ce1b6.exe File created C:\Windows\SysWOW64\uaipqtpo.exe 460065e20051bbf96161a9b3a59ce1b6.exe File opened for modification C:\Windows\SysWOW64\uaipqtpo.exe 460065e20051bbf96161a9b3a59ce1b6.exe File created C:\Windows\SysWOW64\fzdvvdqbhcmhi.exe 460065e20051bbf96161a9b3a59ce1b6.exe File opened for modification C:\Windows\SysWOW64\fzdvvdqbhcmhi.exe 460065e20051bbf96161a9b3a59ce1b6.exe File created C:\Windows\SysWOW64\tqnerdtxhm.exe 460065e20051bbf96161a9b3a59ce1b6.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 460065e20051bbf96161a9b3a59ce1b6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFACCF960F29383753B3786E939E1B38B02FC4363024BE1CC42E609D2" 460065e20051bbf96161a9b3a59ce1b6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB7B12B47E738E252CFB9D633EED7C9" 460065e20051bbf96161a9b3a59ce1b6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8CFC8D485F82689045D7587E94BDEFE143594467336336D79D" 460065e20051bbf96161a9b3a59ce1b6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" tqnerdtxhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg tqnerdtxhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" tqnerdtxhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" tqnerdtxhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" tqnerdtxhm.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 460065e20051bbf96161a9b3a59ce1b6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472D799C2783236D3E76D477222DD67D8664AF" 460065e20051bbf96161a9b3a59ce1b6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C67B14E1DBC2B9BE7FE0EDE337CD" 460065e20051bbf96161a9b3a59ce1b6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat tqnerdtxhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh tqnerdtxhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" tqnerdtxhm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F46BC5FF6621AED27DD1A98A0B906B" 460065e20051bbf96161a9b3a59ce1b6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" tqnerdtxhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc tqnerdtxhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf tqnerdtxhm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs tqnerdtxhm.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 2712 tqnerdtxhm.exe 2712 tqnerdtxhm.exe 2712 tqnerdtxhm.exe 2712 tqnerdtxhm.exe 2712 tqnerdtxhm.exe 2796 uaipqtpo.exe 2796 uaipqtpo.exe 2796 uaipqtpo.exe 2796 uaipqtpo.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 2712 tqnerdtxhm.exe 2712 tqnerdtxhm.exe 2712 tqnerdtxhm.exe 2796 uaipqtpo.exe 2796 uaipqtpo.exe 2796 uaipqtpo.exe 2800 xamzeokkthkybfq.exe 2800 xamzeokkthkybfq.exe 2800 xamzeokkthkybfq.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 1960 460065e20051bbf96161a9b3a59ce1b6.exe 2712 tqnerdtxhm.exe 2712 tqnerdtxhm.exe 2712 tqnerdtxhm.exe 2796 uaipqtpo.exe 2796 uaipqtpo.exe 2796 uaipqtpo.exe 2800 xamzeokkthkybfq.exe 2800 xamzeokkthkybfq.exe 2800 xamzeokkthkybfq.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2712 1960 460065e20051bbf96161a9b3a59ce1b6.exe 23 PID 1960 wrote to memory of 2712 1960 460065e20051bbf96161a9b3a59ce1b6.exe 23 PID 1960 wrote to memory of 2712 1960 460065e20051bbf96161a9b3a59ce1b6.exe 23 PID 1960 wrote to memory of 2712 1960 460065e20051bbf96161a9b3a59ce1b6.exe 23 PID 1960 wrote to memory of 2800 1960 460065e20051bbf96161a9b3a59ce1b6.exe 22 PID 1960 wrote to memory of 2800 1960 460065e20051bbf96161a9b3a59ce1b6.exe 22 PID 1960 wrote to memory of 2800 1960 460065e20051bbf96161a9b3a59ce1b6.exe 22 PID 1960 wrote to memory of 2800 1960 460065e20051bbf96161a9b3a59ce1b6.exe 22 PID 1960 wrote to memory of 2796 1960 460065e20051bbf96161a9b3a59ce1b6.exe 21 PID 1960 wrote to memory of 2796 1960 460065e20051bbf96161a9b3a59ce1b6.exe 21 PID 1960 wrote to memory of 2796 1960 460065e20051bbf96161a9b3a59ce1b6.exe 21 PID 1960 wrote to memory of 2796 1960 460065e20051bbf96161a9b3a59ce1b6.exe 21 PID 1960 wrote to memory of 2020 1960 460065e20051bbf96161a9b3a59ce1b6.exe 19 PID 1960 wrote to memory of 2020 1960 460065e20051bbf96161a9b3a59ce1b6.exe 19 PID 1960 wrote to memory of 2020 1960 460065e20051bbf96161a9b3a59ce1b6.exe 19 PID 1960 wrote to memory of 2020 1960 460065e20051bbf96161a9b3a59ce1b6.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\460065e20051bbf96161a9b3a59ce1b6.exe"C:\Users\Admin\AppData\Local\Temp\460065e20051bbf96161a9b3a59ce1b6.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵PID:2612
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1700
-
-
-
C:\Windows\SysWOW64\fzdvvdqbhcmhi.exefzdvvdqbhcmhi.exe2⤵
- Executes dropped EXE
PID:2020
-
-
C:\Windows\SysWOW64\uaipqtpo.exeuaipqtpo.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2796
-
-
C:\Windows\SysWOW64\xamzeokkthkybfq.exexamzeokkthkybfq.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2800
-
-
C:\Windows\SysWOW64\tqnerdtxhm.exetqnerdtxhm.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2712
-
-
C:\Windows\SysWOW64\uaipqtpo.exeC:\Windows\system32\uaipqtpo.exe1⤵PID:2876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
382KB
MD5badd716c7c48a8241873d9251da496d1
SHA16bd2a072c8f64a1780fe75d983cb7b6584985c6d
SHA256ad4373bfa026f66380b8ce44d6bc300d146770114fb10087019af7c616dc11d7
SHA5127bf3f09216e2ba376053e668963797cd78f91119467917a84f467dd3110d6bd26592784cdf7cefd293413ff5b6dbe10a996d89627177235d9f109732c05f36c5
-
Filesize
512KB
MD5529b23fdb54ba9b252cc7cdd775b4efa
SHA157a9569ab898cba3a04d9100790cfd29dcda30bc
SHA256543335d72c0b7b77b7370be8563e171202e9799840551d0a47feb0dfeea2fde3
SHA512fe134f58f91181751699e2b315d830357d15257b5533d1675081e543f639a515330b61bd11ce7cffef18ea89942eb94e42bad34719d689b65230a25a436cc3ad
-
Filesize
92KB
MD559ebf1358a9b829f5709baaedeeee6fa
SHA11409fd65da1b814db0a08feae54366dfca196f1c
SHA256d251f3126813d9f42461b0d23153c37c405979347a47fb0f04e0503beaf31a06
SHA512a2d71b94a087aa6d376f4f065d9f7ff987fd50ea93949372fa9ef5b6692b45cef7ae267c88376b9d2953e4476496f67af1173e9f0f8ba81101dc94c6872cf417