Analysis
- max time kernel
163s - max time network
178s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
07/01/2024, 19:33
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ad174d4b9f5ec50304261d7f146c0334.exe
Resource
win7-20231215-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad174d4b9f5ec50304261d7f146c0334.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target ad174d4b9f5ec50304261d7f146c0334.exe
- Size 512KB
- Sample240107-x9qsmscfcj
- SHA256 b33aca8831834736fa62cad0770aba0a7fa22e49c2a7b2317af99855708f55d0
- MD5 ad174d4b9f5ec50304261d7f146c0334
- SHA1 6bce4ef8ab8f4986994ab186689b6ab4522bd735
- SHA512 781cdc047b20165f2c7d2b28afa1d9e16d2e285ced0f3522172d6a4a3703fd792f37e3d4f081ae50ce4bc8074321812a7e8d1fb0ae44cb33e63ce273f41e1fea
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5H
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ipbdnenqrc.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ipbdnenqrc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ipbdnenqrc.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ipbdnenqrc.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation ad174d4b9f5ec50304261d7f146c0334.exe - Executes dropped EXE 5 IoCs
pid Process 2128 ipbdnenqrc.exe 4828 azrtmptzcdsltma.exe 1708 jhdjdfka.exe 5092 sxwnzcwcnawed.exe 3900 jhdjdfka.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ipbdnenqrc.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vyukfvde = "ipbdnenqrc.exe" azrtmptzcdsltma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\liznysrd = "azrtmptzcdsltma.exe" azrtmptzcdsltma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "sxwnzcwcnawed.exe" azrtmptzcdsltma.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: jhdjdfka.exe File opened (read-only) \??\a: ipbdnenqrc.exe File opened (read-only) \??\m: ipbdnenqrc.exe File opened (read-only) \??\n: ipbdnenqrc.exe File opened (read-only) \??\r: ipbdnenqrc.exe File opened (read-only) \??\y: ipbdnenqrc.exe File opened (read-only) \??\a: jhdjdfka.exe File opened (read-only) \??\o: jhdjdfka.exe File opened (read-only) \??\r: jhdjdfka.exe File opened (read-only) \??\n: jhdjdfka.exe File opened (read-only) \??\x: ipbdnenqrc.exe File opened (read-only) \??\v: jhdjdfka.exe File opened (read-only) \??\x: jhdjdfka.exe File opened (read-only) \??\y: jhdjdfka.exe File opened (read-only) \??\h: ipbdnenqrc.exe File opened (read-only) \??\o: ipbdnenqrc.exe File opened (read-only) \??\q: ipbdnenqrc.exe File opened (read-only) \??\z: ipbdnenqrc.exe File opened (read-only) \??\v: jhdjdfka.exe File opened (read-only) \??\t: jhdjdfka.exe File opened (read-only) \??\u: ipbdnenqrc.exe File opened (read-only) \??\v: ipbdnenqrc.exe File opened (read-only) \??\q: jhdjdfka.exe File opened (read-only) \??\s: jhdjdfka.exe File opened (read-only) \??\t: jhdjdfka.exe File opened (read-only) \??\u: jhdjdfka.exe File opened (read-only) \??\q: jhdjdfka.exe File opened (read-only) \??\z: jhdjdfka.exe File opened (read-only) \??\b: ipbdnenqrc.exe File opened (read-only) \??\e: ipbdnenqrc.exe File opened (read-only) \??\h: jhdjdfka.exe File opened (read-only) \??\k: ipbdnenqrc.exe File opened (read-only) \??\l: ipbdnenqrc.exe File opened (read-only) \??\e: jhdjdfka.exe File opened (read-only) \??\p: jhdjdfka.exe File opened (read-only) \??\p: ipbdnenqrc.exe File opened (read-only) \??\b: jhdjdfka.exe File opened (read-only) \??\h: jhdjdfka.exe File opened (read-only) \??\j: jhdjdfka.exe File opened (read-only) \??\m: jhdjdfka.exe File opened (read-only) \??\e: jhdjdfka.exe File opened (read-only) \??\g: jhdjdfka.exe File opened (read-only) \??\j: jhdjdfka.exe File opened (read-only) \??\l: jhdjdfka.exe File opened (read-only) \??\o: jhdjdfka.exe File opened (read-only) \??\y: jhdjdfka.exe File opened (read-only) \??\a: jhdjdfka.exe File opened (read-only) \??\k: jhdjdfka.exe File opened (read-only) \??\m: jhdjdfka.exe File opened (read-only) \??\u: jhdjdfka.exe File opened (read-only) \??\g: jhdjdfka.exe File opened (read-only) \??\s: ipbdnenqrc.exe File opened (read-only) \??\x: jhdjdfka.exe File opened (read-only) \??\i: jhdjdfka.exe File opened (read-only) \??\p: jhdjdfka.exe File opened (read-only) \??\t: ipbdnenqrc.exe File opened (read-only) \??\w: ipbdnenqrc.exe File opened (read-only) \??\i: jhdjdfka.exe File opened (read-only) \??\w: jhdjdfka.exe File opened (read-only) \??\i: ipbdnenqrc.exe File opened (read-only) \??\j: ipbdnenqrc.exe File opened (read-only) \??\k: jhdjdfka.exe File opened (read-only) \??\r: jhdjdfka.exe File opened (read-only) \??\z: jhdjdfka.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ipbdnenqrc.exe - AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1408-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000200000001e7dd-5.dat autoit_exe behavioral2/files/0x000300000001e7dc-18.dat autoit_exe behavioral2/files/0x000200000001e7de-26.dat autoit_exe behavioral2/files/0x000200000001e7df-31.dat autoit_exe behavioral2/files/0x000300000001e7ea-50.dat autoit_exe behavioral2/files/0x000500000001e7e9-47.dat autoit_exe behavioral2/files/0x000600000002314c-121.dat autoit_exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ipbdnenqrc.exe ad174d4b9f5ec50304261d7f146c0334.exe File opened for modification C:\Windows\SysWOW64\ipbdnenqrc.exe ad174d4b9f5ec50304261d7f146c0334.exe File created C:\Windows\SysWOW64\azrtmptzcdsltma.exe ad174d4b9f5ec50304261d7f146c0334.exe File opened for modification C:\Windows\SysWOW64\jhdjdfka.exe ad174d4b9f5ec50304261d7f146c0334.exe File opened for modification C:\Windows\SysWOW64\sxwnzcwcnawed.exe ad174d4b9f5ec50304261d7f146c0334.exe File opened for modification C:\Windows\SysWOW64\azrtmptzcdsltma.exe ad174d4b9f5ec50304261d7f146c0334.exe File created C:\Windows\SysWOW64\jhdjdfka.exe ad174d4b9f5ec50304261d7f146c0334.exe File created C:\Windows\SysWOW64\sxwnzcwcnawed.exe ad174d4b9f5ec50304261d7f146c0334.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ipbdnenqrc.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jhdjdfka.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jhdjdfka.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jhdjdfka.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf ad174d4b9f5ec50304261d7f146c0334.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ipbdnenqrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB4F9BEFE16F2E2837D3A41819F3EE2B08C02F04212034CE2CA42ED08D2" ad174d4b9f5ec50304261d7f146c0334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F768C3FF1821AAD209D1A88A7D9116" ad174d4b9f5ec50304261d7f146c0334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ipbdnenqrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ipbdnenqrc.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes ad174d4b9f5ec50304261d7f146c0334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33352D789C5283206A3276D570512DDF7CF564DA" ad174d4b9f5ec50304261d7f146c0334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC6781491DAB5B9CD7FE7ECE734CD" ad174d4b9f5ec50304261d7f146c0334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC1B15B479539E853CABAD4329ED7BC" ad174d4b9f5ec50304261d7f146c0334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ipbdnenqrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ipbdnenqrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8BFC8F4F27851F9032D75D7E92BDEEE13C594666406344D790" ad174d4b9f5ec50304261d7f146c0334.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ipbdnenqrc.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings ad174d4b9f5ec50304261d7f146c0334.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4824 WINWORD.EXE 4824 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 3900 jhdjdfka.exe 3900 jhdjdfka.exe 3900 jhdjdfka.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 1408 ad174d4b9f5ec50304261d7f146c0334.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 2128 ipbdnenqrc.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 4828 azrtmptzcdsltma.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 1708 jhdjdfka.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 5092 sxwnzcwcnawed.exe 3900 jhdjdfka.exe 3900 jhdjdfka.exe 3900 jhdjdfka.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4824 WINWORD.EXE 4824 WINWORD.EXE 4824 WINWORD.EXE 4824 WINWORD.EXE 4824 WINWORD.EXE 4824 WINWORD.EXE 4824 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1408 wrote to memory of 2128 1408 ad174d4b9f5ec50304261d7f146c0334.exe 91 PID 1408 wrote to memory of 2128 1408 ad174d4b9f5ec50304261d7f146c0334.exe 91 PID 1408 wrote to memory of 2128 1408 ad174d4b9f5ec50304261d7f146c0334.exe 91 PID 1408 wrote to memory of 4828 1408 ad174d4b9f5ec50304261d7f146c0334.exe 92 PID 1408 wrote to memory of 4828 1408 ad174d4b9f5ec50304261d7f146c0334.exe 92 PID 1408 wrote to memory of 4828 1408 ad174d4b9f5ec50304261d7f146c0334.exe 92 PID 1408 wrote to memory of 1708 1408 ad174d4b9f5ec50304261d7f146c0334.exe 93 PID 1408 wrote to memory of 1708 1408 ad174d4b9f5ec50304261d7f146c0334.exe 93 PID 1408 wrote to memory of 1708 1408 ad174d4b9f5ec50304261d7f146c0334.exe 93 PID 1408 wrote to memory of 5092 1408 ad174d4b9f5ec50304261d7f146c0334.exe 94 PID 1408 wrote to memory of 5092 1408 ad174d4b9f5ec50304261d7f146c0334.exe 94 PID 1408 wrote to memory of 5092 1408 ad174d4b9f5ec50304261d7f146c0334.exe 94 PID 2128 wrote to memory of 3900 2128 ipbdnenqrc.exe 95 PID 2128 wrote to memory of 3900 2128 ipbdnenqrc.exe 95 PID 2128 wrote to memory of 3900 2128 ipbdnenqrc.exe 95 PID 1408 wrote to memory of 4824 1408 ad174d4b9f5ec50304261d7f146c0334.exe 97 PID 1408 wrote to memory of 4824 1408 ad174d4b9f5ec50304261d7f146c0334.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad174d4b9f5ec50304261d7f146c0334.exe"C:\Users\Admin\AppData\Local\Temp\ad174d4b9f5ec50304261d7f146c0334.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\ipbdnenqrc.exeipbdnenqrc.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\jhdjdfka.exeC:\Windows\system32\jhdjdfka.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3900
-
-
-
C:\Windows\SysWOW64\azrtmptzcdsltma.exeazrtmptzcdsltma.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4828
-
-
C:\Windows\SysWOW64\jhdjdfka.exejhdjdfka.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1708
-
-
C:\Windows\SysWOW64\sxwnzcwcnawed.exesxwnzcwcnawed.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5092
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4824
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 7d4fa79294f5add52a915596b4a5db97623f15bb0f8fec57d711f657c74762a3
- MD5 d60a49140a8d1dd7b79bbcdfbad04f5d
- SHA1 b67afb74eb6648a0a29fe3d2af68276c10091a97
- SHA512 6b62446649bb48bbd00cf02060b210a4b6b041f96f07774852ee0d229d9468a4fc765ab40249d61de83f1667d5f2b505e3539e72a60c0b3a1fa18382da2ae357
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 ec17ff3eb4089b4729c33fd26fe73bbf02c257ab9381df5a6423727a30f7af73
- MD5 7ef51a4e2ac3f1412fb29a7e159ad521
- SHA1 eb6cb7f05ea9c013e92bc91249d85e86bd4b78ff
- SHA512 fc8f4c1343c5b6d714508565d573995216b197bf4d2b37c42442fc92488d05f54943af863ef189792496f40ca91d9533063fa42407cb5cef079f66f41f7403df
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 52d9743d700d09ab083c97a6dce944f5e14f9736b70157f42c12bd25c788be8d
- MD5 09aa404235ab3e02a5a7825f308b0580
- SHA1 1136d3c70b6571afa9b06e8dc5bf73852f09dc4d
- SHA512 de8efddbe4cb284fc3387f21df517dab82a6c3842ee216f43cc27aee8ac42216f6e2d38b9e27876ddfcf976cb412c3715232cbf642035c14c336e8ee1ddb83c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 1b5f8904742edd6a227531b5a8fa84a6eb35ec51f60adb36097ad2a293ac15f9
- MD5 d464293d0412f597ecadec48aa9624a0
- SHA1 e9ffa7dc4e9b597766f62a4fd7a6310922427192
- SHA512 21adc4b0243a1ab8e0df34ef0f1efc9b6ade87ccbc88b3a7a70670bb91d3adfa72af8c0cfdfe157182fe80dc42cfecf719463a00b0d927f48f10ddf0ff417f8f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\SaveAdd.doc.exe
- Size 512KB
- SHA256 74fd2a68984dd00ee92caf6d8075266a3ab470b338f3dea40919ebc3358a7321
- MD5 fa9b04edbc6b4f5f6a5d048af914b743
- SHA1 fd0fede88cda881da4772b9b651f22e4f7d74f6a
- SHA512 a2cf7345d0af4992d95122cdb0470e296936b204c69e2f275e0f793873d3d13e1144c73c023aab12bb07dd1f171e8aecc191fd2554a86ec277a2fc53c010bab7
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6t:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\azrtmptzcdsltma.exe
- Size 512KB
- SHA256 13fc666c3f23488b5903ffd2f2bc5aacf5c507c98f11df4803fd4121c739e007
- MD5 2505f7a7419e285742d437ec67f876c3
- SHA1 f2ebad795a34f063de320f3383bdd805c539cc9f
- SHA512 39647abed199422fd360115641865adafea33fab798fcdf500aba29a11a4e33de0918ad30fe3dd16ee9e068abb9bba2e3eb5be508689fe670ad97811b74b2c5d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ipbdnenqrc.exe
- Size 512KB
- SHA256 066be355a5976ba2acb21c21c6a4c11267a83a7152215ad4e691d806669eb25c
- MD5 87aca6dd02e6b5d55d03c8522153926a
- SHA1 90d2d72ae9414d47cf485ac3b47ee6c4becc8236
- SHA512 0264e4eb9602f411b18cff7d0bb80d26d56bf8cf82a36c68c2497ed2cfa324707bafbe399ddae92f6addd600e22572c073619dec5ca7f3ddfe2c1b5e152affbc
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\jhdjdfka.exe
- Size 512KB
- SHA256 de4bff6e999749f07b59fbc5e154ec230aa1710b8abc56642e6b059f5c80a150
- MD5 2a55a306627bda815b5d1668f1697528
- SHA1 4389ed1bd2c6084e93051b7e4f19ff57422484c7
- SHA512 74005c26c6f09aa8bc6b06fa033e15b3deda7a94c8c4f97fef6a80366b9eca29403c0fa9e55ca22d5072d71746dbda490f07437b0c5fb9eeea496fcfa7195d76
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5L
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sxwnzcwcnawed.exe
- Size 512KB
- SHA256 8706c37c218390557c33fc7c7c18971047bdbae3d2ecd4a4ee370d51cd6689e0
- MD5 9a2af7d13e42ebefe0558dd6ed4bc921
- SHA1 b5fb909ba8a9e0905902573bcc90333c2442bd34
- SHA512 f915f12150bacf6a5ffd95c0bf39041c1edc181617428e7afaa4914f39b6a45a32bad5569e6c8a55c49c8c7a2efc59ce9cc0f16de3046a8326aba7f1084512f5
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6r:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512