Analysis
- max time kernel
158s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
07/01/2024, 19:33
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
aa004dee0751926cb4ba5a24246781b2.exe
Resource
win7-20231215-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa004dee0751926cb4ba5a24246781b2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target aa004dee0751926cb4ba5a24246781b2.exe
- Size 512KB
- Sample240107-x9sl8sded2
- SHA256 ceb3b395283674b93d8ee33cca56b78d1b5cd2bc018ec78be506b193a340ac94
- MD5 aa004dee0751926cb4ba5a24246781b2
- SHA1 ac48b443f46dd2af7722b772993ffd0207ab549c
- SHA512 7f7f7f2fbf1f0d9bab8be50ba6449187495f11fcb1e7348946c6737be60e1e9c0dbab96f62eeba6bf8d6214d56181dbfdc934267241ccb2f57fad08388c41378
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5p
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ipbdnenqrc.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ipbdnenqrc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ipbdnenqrc.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ipbdnenqrc.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation aa004dee0751926cb4ba5a24246781b2.exe - Executes dropped EXE 5 IoCs
pid Process 4296 ipbdnenqrc.exe 1416 azrtmptzcdsltma.exe 3556 jhdjdfka.exe 776 sxwnzcwcnawed.exe 3428 jhdjdfka.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ipbdnenqrc.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\liznysrd = "azrtmptzcdsltma.exe" azrtmptzcdsltma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "sxwnzcwcnawed.exe" azrtmptzcdsltma.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vyukfvde = "ipbdnenqrc.exe" azrtmptzcdsltma.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: jhdjdfka.exe File opened (read-only) \??\z: jhdjdfka.exe File opened (read-only) \??\p: ipbdnenqrc.exe File opened (read-only) \??\r: ipbdnenqrc.exe File opened (read-only) \??\l: jhdjdfka.exe File opened (read-only) \??\z: jhdjdfka.exe File opened (read-only) \??\j: jhdjdfka.exe File opened (read-only) \??\t: jhdjdfka.exe File opened (read-only) \??\e: ipbdnenqrc.exe File opened (read-only) \??\a: jhdjdfka.exe File opened (read-only) \??\m: jhdjdfka.exe File opened (read-only) \??\t: jhdjdfka.exe File opened (read-only) \??\y: jhdjdfka.exe File opened (read-only) \??\q: ipbdnenqrc.exe File opened (read-only) \??\n: jhdjdfka.exe File opened (read-only) \??\v: jhdjdfka.exe File opened (read-only) \??\k: jhdjdfka.exe File opened (read-only) \??\o: jhdjdfka.exe File opened (read-only) \??\q: jhdjdfka.exe File opened (read-only) \??\r: jhdjdfka.exe File opened (read-only) \??\o: ipbdnenqrc.exe File opened (read-only) \??\e: jhdjdfka.exe File opened (read-only) \??\h: jhdjdfka.exe File opened (read-only) \??\o: jhdjdfka.exe File opened (read-only) \??\b: jhdjdfka.exe File opened (read-only) \??\l: jhdjdfka.exe File opened (read-only) \??\n: jhdjdfka.exe File opened (read-only) \??\u: jhdjdfka.exe File opened (read-only) \??\b: ipbdnenqrc.exe File opened (read-only) \??\j: ipbdnenqrc.exe File opened (read-only) \??\n: ipbdnenqrc.exe File opened (read-only) \??\t: ipbdnenqrc.exe File opened (read-only) \??\j: jhdjdfka.exe File opened (read-only) \??\e: jhdjdfka.exe File opened (read-only) \??\v: jhdjdfka.exe File opened (read-only) \??\k: ipbdnenqrc.exe File opened (read-only) \??\u: ipbdnenqrc.exe File opened (read-only) \??\a: ipbdnenqrc.exe File opened (read-only) \??\i: ipbdnenqrc.exe File opened (read-only) \??\g: jhdjdfka.exe File opened (read-only) \??\k: jhdjdfka.exe File opened (read-only) \??\s: jhdjdfka.exe File opened (read-only) \??\b: jhdjdfka.exe File opened (read-only) \??\y: jhdjdfka.exe File opened (read-only) \??\z: ipbdnenqrc.exe File opened (read-only) \??\i: jhdjdfka.exe File opened (read-only) \??\q: jhdjdfka.exe File opened (read-only) \??\i: jhdjdfka.exe File opened (read-only) \??\m: jhdjdfka.exe File opened (read-only) \??\x: jhdjdfka.exe File opened (read-only) \??\g: ipbdnenqrc.exe File opened (read-only) \??\w: jhdjdfka.exe File opened (read-only) \??\p: jhdjdfka.exe File opened (read-only) \??\y: ipbdnenqrc.exe File opened (read-only) \??\u: jhdjdfka.exe File opened (read-only) \??\h: jhdjdfka.exe File opened (read-only) \??\w: jhdjdfka.exe File opened (read-only) \??\h: ipbdnenqrc.exe File opened (read-only) \??\l: ipbdnenqrc.exe File opened (read-only) \??\x: ipbdnenqrc.exe File opened (read-only) \??\x: jhdjdfka.exe File opened (read-only) \??\a: jhdjdfka.exe File opened (read-only) \??\r: jhdjdfka.exe File opened (read-only) \??\s: jhdjdfka.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ipbdnenqrc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ipbdnenqrc.exe - AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2572-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000300000001e715-5.dat autoit_exe behavioral2/files/0x000600000001e0ce-19.dat autoit_exe behavioral2/files/0x000200000001e7c9-25.dat autoit_exe behavioral2/files/0x000300000001e7dc-28.dat autoit_exe behavioral2/files/0x000200000001e7f4-55.dat autoit_exe behavioral2/files/0x000200000001e7f5-58.dat autoit_exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ipbdnenqrc.exe aa004dee0751926cb4ba5a24246781b2.exe File created C:\Windows\SysWOW64\azrtmptzcdsltma.exe aa004dee0751926cb4ba5a24246781b2.exe File opened for modification C:\Windows\SysWOW64\azrtmptzcdsltma.exe aa004dee0751926cb4ba5a24246781b2.exe File created C:\Windows\SysWOW64\jhdjdfka.exe aa004dee0751926cb4ba5a24246781b2.exe File created C:\Windows\SysWOW64\ipbdnenqrc.exe aa004dee0751926cb4ba5a24246781b2.exe File opened for modification C:\Windows\SysWOW64\jhdjdfka.exe aa004dee0751926cb4ba5a24246781b2.exe File created C:\Windows\SysWOW64\sxwnzcwcnawed.exe aa004dee0751926cb4ba5a24246781b2.exe File opened for modification C:\Windows\SysWOW64\sxwnzcwcnawed.exe aa004dee0751926cb4ba5a24246781b2.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ipbdnenqrc.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal jhdjdfka.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jhdjdfka.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe jhdjdfka.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal jhdjdfka.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf aa004dee0751926cb4ba5a24246781b2.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB4F9BEFE16F2E2837D3A41819F3EE2B08C02F04212034CE2CA42ED08D2" aa004dee0751926cb4ba5a24246781b2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ipbdnenqrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC6781491DAB5B9CD7FE7ECE734CD" aa004dee0751926cb4ba5a24246781b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ipbdnenqrc.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings aa004dee0751926cb4ba5a24246781b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33352D789C5283206A3276D570512DDF7CF564DA" aa004dee0751926cb4ba5a24246781b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC1B15B479539E853CABAD4329ED7BC" aa004dee0751926cb4ba5a24246781b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ipbdnenqrc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ipbdnenqrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ipbdnenqrc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ipbdnenqrc.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes aa004dee0751926cb4ba5a24246781b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8BFC8F4F27851F9032D75D7E92BDEEE13C594666406344D790" aa004dee0751926cb4ba5a24246781b2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F768C3FF1821AAD209D1A88A7D9116" aa004dee0751926cb4ba5a24246781b2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ipbdnenqrc.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4288 WINWORD.EXE 4288 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3428 jhdjdfka.exe 3428 jhdjdfka.exe 3428 jhdjdfka.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 2572 aa004dee0751926cb4ba5a24246781b2.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 4296 ipbdnenqrc.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 1416 azrtmptzcdsltma.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 776 sxwnzcwcnawed.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3556 jhdjdfka.exe 3428 jhdjdfka.exe 3428 jhdjdfka.exe 3428 jhdjdfka.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE 4288 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2572 wrote to memory of 4296 2572 aa004dee0751926cb4ba5a24246781b2.exe 92 PID 2572 wrote to memory of 4296 2572 aa004dee0751926cb4ba5a24246781b2.exe 92 PID 2572 wrote to memory of 4296 2572 aa004dee0751926cb4ba5a24246781b2.exe 92 PID 2572 wrote to memory of 1416 2572 aa004dee0751926cb4ba5a24246781b2.exe 94 PID 2572 wrote to memory of 1416 2572 aa004dee0751926cb4ba5a24246781b2.exe 94 PID 2572 wrote to memory of 1416 2572 aa004dee0751926cb4ba5a24246781b2.exe 94 PID 2572 wrote to memory of 3556 2572 aa004dee0751926cb4ba5a24246781b2.exe 95 PID 2572 wrote to memory of 3556 2572 aa004dee0751926cb4ba5a24246781b2.exe 95 PID 2572 wrote to memory of 3556 2572 aa004dee0751926cb4ba5a24246781b2.exe 95 PID 2572 wrote to memory of 776 2572 aa004dee0751926cb4ba5a24246781b2.exe 96 PID 2572 wrote to memory of 776 2572 aa004dee0751926cb4ba5a24246781b2.exe 96 PID 2572 wrote to memory of 776 2572 aa004dee0751926cb4ba5a24246781b2.exe 96 PID 4296 wrote to memory of 3428 4296 ipbdnenqrc.exe 97 PID 4296 wrote to memory of 3428 4296 ipbdnenqrc.exe 97 PID 4296 wrote to memory of 3428 4296 ipbdnenqrc.exe 97 PID 2572 wrote to memory of 4288 2572 aa004dee0751926cb4ba5a24246781b2.exe 99 PID 2572 wrote to memory of 4288 2572 aa004dee0751926cb4ba5a24246781b2.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa004dee0751926cb4ba5a24246781b2.exe"C:\Users\Admin\AppData\Local\Temp\aa004dee0751926cb4ba5a24246781b2.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\ipbdnenqrc.exeipbdnenqrc.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\jhdjdfka.exeC:\Windows\system32\jhdjdfka.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3428
-
-
-
C:\Windows\SysWOW64\azrtmptzcdsltma.exeazrtmptzcdsltma.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1416
-
-
C:\Windows\SysWOW64\jhdjdfka.exejhdjdfka.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3556
-
-
C:\Windows\SysWOW64\sxwnzcwcnawed.exesxwnzcwcnawed.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:776
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4288
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 41ad2329e79ac18ae0c01992942797532db210c43135ae9f081938380a5f0daf
- MD5 72255d2a16b22fea5c3ff31d34831d4d
- SHA1 5756fd4282c321d7ab2b86465deed4fefde86379
- SHA512 604c6b5747467a1990e0af64d41d685c3d2a59d1eb6d0a9e69a22409666682f720e88675d4d2f3338de360280d9df4a403abd1c93e8965efb1af16c2f7e7d9c1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 007c5d5b0c975637155703612fade5ae1bfa91a576184fb587691bb0beab938e
- MD5 a492c5b955d4c6c878d4904d61e92645
- SHA1 20c00f0771958dca51755512672020f2294aa9e6
- SHA512 63aa26c3ba8ff324ab8baae4a0cdff9f50fe1f7ef1f7686caabe13c8a70e0c3295946efe949852001e61e022c5ac3131ad490d8bd9a2ddc902d64c133e692d76
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 307ced21a31e0c0697c23aab1e76985f907c1984e7b23d5df02fbde17c2181d5
- MD5 c7a6983e8b4ac0a6085a11f2244d14be
- SHA1 b9fd9876cc354358a9194aa3f49bd80ce1d07467
- SHA512 6f004652a581ac9cb972a558bc242ba0420192dcd85d8d73dc33e105e839e39f68328aa8150042bae40eb2184c2d53338486ba7332aae4eda01cd63c43e1560a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 2fa54aaf0ddf020719f0798cc3dd412b2888733cfd2d3d13c46a1de20caea674
- MD5 e8b1c7a45272a4a8023c7852e7982119
- SHA1 9f7e2fe5828bc3513a7432548cc859983d7317b6
- SHA512 423f4c90890783e975bf6c9f66d141832af998e6dc6403f0bb82a0e695e5ce33c3b202d6a167b81699bd1063896da0aada1d1825a13a07dae425e2756019a05d
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\azrtmptzcdsltma.exe
- Size 512KB
- SHA256 2c945044eab43d30ba89bd76189b36ae9f8987c673bf61232ebb687cb2ac7cce
- MD5 3279c9fb0a704ec168fe5ec17ccae640
- SHA1 7a04a65f0637011539238c2e1a99c11308e40f5c
- SHA512 b5331d1a954de3b6777ab2c6ac80035ab81a563e5316c8f71c2af644117e41943bb94d05d4a87c686c0162e7ce2ef895d9fe805645491bebb41bbaa454f23c1f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm56
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ipbdnenqrc.exe
- Size 512KB
- SHA256 ed380116e481a79582fca2b7be0e6339a0689c8ca1a287f2741ed0f968ff9e85
- MD5 aa5844b9b3da177dfe222c35744bd3be
- SHA1 80a7d0930b687694196fc7a148acef1431081927
- SHA512 d9ce9d417ac813ac0b806469cdd0155cac71e62af295af79a49eff0967ceabd361c9604a670d1b2b58ff6e20edf1011780676e831cd04b10d374e333af33e42f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\jhdjdfka.exe
- Size 512KB
- SHA256 820403498c7ae40a13d316769453c557f4d561d8c9ec9e702ed5cd796cb55c86
- MD5 a579eb1bfc4147bb7b05afcd0c0c1521
- SHA1 f8bef6acc97810261b48d1a444e5538d8ea44ab2
- SHA512 80aaff4c6fffbcdc29c5e8e23b133b33e531a749fa7e176da10758cf6167a02e56317a29d6ac76dc8a9b6b7e86533dfaa3c0ca494f49068414fe899286dd345d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sxwnzcwcnawed.exe
- Size 512KB
- SHA256 b66feb302a1cab8a5c09dd49b40f791e682a71697b56563e247fe825f6dd747c
- MD5 ccd0dca5f086afa01b073221c5a19c9c
- SHA1 e8caf6f74bc9ec6c7f2a7143fd81aacbfa9c2bd4
- SHA512 71f0313c754af38ec843e7bb5001619a1f113138be3d2ddb9377782369d8d70ee50354bed60a55de65eb19748b8689eb733d75a5a8ff55d3f2e55f1cdacf16bd
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512