Analysis
- max time kernel
151s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
07/01/2024, 19:14
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
494c13423fc557400666c50f8f6d86ae.exe
Resource
win7-20231129-en
windows7-x64
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
494c13423fc557400666c50f8f6d86ae.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 494c13423fc557400666c50f8f6d86ae.exe
- Size 512KB
- Sample240107-xxpd2sdbb2
- SHA256 2d8d7ac5ed55b003a14cc2cce35099461b5be331b2ee4b7f607e79eeab1090ca
- MD5 494c13423fc557400666c50f8f6d86ae
- SHA1 1bf13b5a832bce07639bd5f1b2fe532dd604ab9f
- SHA512 15b829170b7d8039aaa4a331f102beb5753ccb96624812879f8389608658bc71931e2626f7103943c85bf8f5f8b642838c9d3e208e3acd0ab793abbe98195058
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" kyuylzevqi.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kyuylzevqi.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kyuylzevqi.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kyuylzevqi.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 494c13423fc557400666c50f8f6d86ae.exe - Executes dropped EXE 5 IoCs
pid Process 5004 kyuylzevqi.exe 4068 zxlxnximlqokmch.exe 1304 oxcvztii.exe 3068 krjklfpbfhzab.exe 5092 oxcvztii.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" kyuylzevqi.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\idxpgwmm = "kyuylzevqi.exe" zxlxnximlqokmch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kiggvffy = "zxlxnximlqokmch.exe" zxlxnximlqokmch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "krjklfpbfhzab.exe" zxlxnximlqokmch.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: kyuylzevqi.exe File opened (read-only) \??\r: kyuylzevqi.exe File opened (read-only) \??\t: kyuylzevqi.exe File opened (read-only) \??\e: oxcvztii.exe File opened (read-only) \??\b: oxcvztii.exe File opened (read-only) \??\k: oxcvztii.exe File opened (read-only) \??\x: oxcvztii.exe File opened (read-only) \??\b: kyuylzevqi.exe File opened (read-only) \??\x: oxcvztii.exe File opened (read-only) \??\v: kyuylzevqi.exe File opened (read-only) \??\l: oxcvztii.exe File opened (read-only) \??\u: oxcvztii.exe File opened (read-only) \??\r: oxcvztii.exe File opened (read-only) \??\z: oxcvztii.exe File opened (read-only) \??\i: kyuylzevqi.exe File opened (read-only) \??\o: kyuylzevqi.exe File opened (read-only) \??\r: oxcvztii.exe File opened (read-only) \??\j: kyuylzevqi.exe File opened (read-only) \??\y: kyuylzevqi.exe File opened (read-only) \??\z: kyuylzevqi.exe File opened (read-only) \??\m: oxcvztii.exe File opened (read-only) \??\a: oxcvztii.exe File opened (read-only) \??\q: kyuylzevqi.exe File opened (read-only) \??\i: oxcvztii.exe File opened (read-only) \??\z: oxcvztii.exe File opened (read-only) \??\b: oxcvztii.exe File opened (read-only) \??\j: oxcvztii.exe File opened (read-only) \??\s: oxcvztii.exe File opened (read-only) \??\y: oxcvztii.exe File opened (read-only) \??\e: oxcvztii.exe File opened (read-only) \??\n: oxcvztii.exe File opened (read-only) \??\g: kyuylzevqi.exe File opened (read-only) \??\h: kyuylzevqi.exe File opened (read-only) \??\i: oxcvztii.exe File opened (read-only) \??\h: oxcvztii.exe File opened (read-only) \??\n: oxcvztii.exe File opened (read-only) \??\g: oxcvztii.exe File opened (read-only) \??\s: kyuylzevqi.exe File opened (read-only) \??\y: oxcvztii.exe File opened (read-only) \??\l: kyuylzevqi.exe File opened (read-only) \??\q: oxcvztii.exe File opened (read-only) \??\l: oxcvztii.exe File opened (read-only) \??\o: oxcvztii.exe File opened (read-only) \??\p: oxcvztii.exe File opened (read-only) \??\v: oxcvztii.exe File opened (read-only) \??\k: oxcvztii.exe File opened (read-only) \??\t: oxcvztii.exe File opened (read-only) \??\q: oxcvztii.exe File opened (read-only) \??\w: kyuylzevqi.exe File opened (read-only) \??\g: oxcvztii.exe File opened (read-only) \??\x: kyuylzevqi.exe File opened (read-only) \??\a: oxcvztii.exe File opened (read-only) \??\o: oxcvztii.exe File opened (read-only) \??\m: oxcvztii.exe File opened (read-only) \??\k: kyuylzevqi.exe File opened (read-only) \??\p: oxcvztii.exe File opened (read-only) \??\v: oxcvztii.exe File opened (read-only) \??\u: kyuylzevqi.exe File opened (read-only) \??\h: oxcvztii.exe File opened (read-only) \??\w: oxcvztii.exe File opened (read-only) \??\a: kyuylzevqi.exe File opened (read-only) \??\m: kyuylzevqi.exe File opened (read-only) \??\j: oxcvztii.exe File opened (read-only) \??\s: oxcvztii.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" kyuylzevqi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" kyuylzevqi.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3200-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000600000002323b-5.dat autoit_exe behavioral2/files/0x000600000002323a-19.dat autoit_exe behavioral2/files/0x000600000002323d-32.dat autoit_exe behavioral2/files/0x000600000002323c-27.dat autoit_exe behavioral2/files/0x00080000000231b5-81.dat autoit_exe behavioral2/files/0x0002000000022768-75.dat autoit_exe behavioral2/files/0x000600000002327c-104.dat autoit_exe behavioral2/files/0x000600000002328a-112.dat autoit_exe behavioral2/files/0x000600000002328a-119.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\zxlxnximlqokmch.exe 494c13423fc557400666c50f8f6d86ae.exe File created C:\Windows\SysWOW64\oxcvztii.exe 494c13423fc557400666c50f8f6d86ae.exe File opened for modification C:\Windows\SysWOW64\oxcvztii.exe 494c13423fc557400666c50f8f6d86ae.exe File created C:\Windows\SysWOW64\krjklfpbfhzab.exe 494c13423fc557400666c50f8f6d86ae.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe oxcvztii.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe oxcvztii.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe oxcvztii.exe File created C:\Windows\SysWOW64\kyuylzevqi.exe 494c13423fc557400666c50f8f6d86ae.exe File opened for modification C:\Windows\SysWOW64\kyuylzevqi.exe 494c13423fc557400666c50f8f6d86ae.exe File opened for modification C:\Windows\SysWOW64\zxlxnximlqokmch.exe 494c13423fc557400666c50f8f6d86ae.exe File opened for modification C:\Windows\SysWOW64\krjklfpbfhzab.exe 494c13423fc557400666c50f8f6d86ae.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll kyuylzevqi.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe oxcvztii.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal oxcvztii.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe oxcvztii.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal oxcvztii.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal oxcvztii.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe oxcvztii.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe oxcvztii.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe oxcvztii.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe oxcvztii.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe oxcvztii.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe oxcvztii.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe oxcvztii.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe oxcvztii.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe oxcvztii.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal oxcvztii.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 494c13423fc557400666c50f8f6d86ae.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat kyuylzevqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc kyuylzevqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg kyuylzevqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh kyuylzevqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" kyuylzevqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC4B05B4794389D52C4B9D6329CD7CF" 494c13423fc557400666c50f8f6d86ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC67815E5DAC7B9B97CE2EDE337B9" 494c13423fc557400666c50f8f6d86ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kyuylzevqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kyuylzevqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kyuylzevqi.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings 494c13423fc557400666c50f8f6d86ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332D089D2C82566A3077A170232DD87C8F64AB" 494c13423fc557400666c50f8f6d86ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" kyuylzevqi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs kyuylzevqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7816BB1FF6C22D8D20ED1A98A749167" 494c13423fc557400666c50f8f6d86ae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf kyuylzevqi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" kyuylzevqi.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 494c13423fc557400666c50f8f6d86ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFF9BCF961F291837E3A3286EB39E3B0FA038A43670332E1BA429C08A2" 494c13423fc557400666c50f8f6d86ae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFCFC482A851A9134D7217E95BDEFE13459306636633FD7ED" 494c13423fc557400666c50f8f6d86ae.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4484 WINWORD.EXE 4484 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 4068 zxlxnximlqokmch.exe 5004 kyuylzevqi.exe 4068 zxlxnximlqokmch.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 4068 zxlxnximlqokmch.exe 5004 kyuylzevqi.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 5092 oxcvztii.exe 5092 oxcvztii.exe 5092 oxcvztii.exe 5092 oxcvztii.exe 5092 oxcvztii.exe 5092 oxcvztii.exe 5092 oxcvztii.exe 5092 oxcvztii.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 5092 oxcvztii.exe 5092 oxcvztii.exe 5092 oxcvztii.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 3200 494c13423fc557400666c50f8f6d86ae.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 5004 kyuylzevqi.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 4068 zxlxnximlqokmch.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 1304 oxcvztii.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 3068 krjklfpbfhzab.exe 5092 oxcvztii.exe 5092 oxcvztii.exe 5092 oxcvztii.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE 4484 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3200 wrote to memory of 5004 3200 494c13423fc557400666c50f8f6d86ae.exe 89 PID 3200 wrote to memory of 5004 3200 494c13423fc557400666c50f8f6d86ae.exe 89 PID 3200 wrote to memory of 5004 3200 494c13423fc557400666c50f8f6d86ae.exe 89 PID 3200 wrote to memory of 4068 3200 494c13423fc557400666c50f8f6d86ae.exe 92 PID 3200 wrote to memory of 4068 3200 494c13423fc557400666c50f8f6d86ae.exe 92 PID 3200 wrote to memory of 4068 3200 494c13423fc557400666c50f8f6d86ae.exe 92 PID 3200 wrote to memory of 1304 3200 494c13423fc557400666c50f8f6d86ae.exe 90 PID 3200 wrote to memory of 1304 3200 494c13423fc557400666c50f8f6d86ae.exe 90 PID 3200 wrote to memory of 1304 3200 494c13423fc557400666c50f8f6d86ae.exe 90 PID 3200 wrote to memory of 3068 3200 494c13423fc557400666c50f8f6d86ae.exe 91 PID 3200 wrote to memory of 3068 3200 494c13423fc557400666c50f8f6d86ae.exe 91 PID 3200 wrote to memory of 3068 3200 494c13423fc557400666c50f8f6d86ae.exe 91 PID 3200 wrote to memory of 4484 3200 494c13423fc557400666c50f8f6d86ae.exe 93 PID 3200 wrote to memory of 4484 3200 494c13423fc557400666c50f8f6d86ae.exe 93 PID 5004 wrote to memory of 5092 5004 kyuylzevqi.exe 95 PID 5004 wrote to memory of 5092 5004 kyuylzevqi.exe 95 PID 5004 wrote to memory of 5092 5004 kyuylzevqi.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\494c13423fc557400666c50f8f6d86ae.exe"C:\Users\Admin\AppData\Local\Temp\494c13423fc557400666c50f8f6d86ae.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\kyuylzevqi.exekyuylzevqi.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\oxcvztii.exeC:\Windows\system32\oxcvztii.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5092
-
-
-
C:\Windows\SysWOW64\oxcvztii.exeoxcvztii.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1304
-
-
C:\Windows\SysWOW64\krjklfpbfhzab.exekrjklfpbfhzab.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3068
-
-
C:\Windows\SysWOW64\zxlxnximlqokmch.exezxlxnximlqokmch.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4068
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4484
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 deffdcffc2799365b53d4cf4d58a610513c78f6ef733ce47c558eb545465ac63
- MD5 549f70410ecab2cd595a34b0878ed564
- SHA1 4e53ede73868d2c3b17e62ca3ff0f8651e4e1d51
- SHA512 9ef72757f4e4c7bf536902b50ccbd66895aeb16e3aab00390a386ef9a8af59b1596d1749e005ff82bf42d6c97a496a4df0ceadf321b3efa28fbe74902ad3aa19
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6j:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 df3e33dd323f6e868f28b058c5891dc3f6c610a8f3c9d9687155a621729a52ad
- MD5 add9ecd5d258a79a22e3e5539a7255d2
- SHA1 4b1db3ad8cea94410c728eba9c45d6fb5203ab29
- SHA512 9a76f4f85cde6b24f831b28b24cd4251d918f3d3812447b2e6c4e7bd9b1e124965fc23812f4a84829c9e00c21a362863611b800940bb0d99b1bbefd17ffa03df
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5W
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 62d541335dd2c855f8cf2c10b799aa5b4462fb9d799282a6a6acf5a747bdbfc6
- MD5 42033c511bcc7e1970e3c45cb786f794
- SHA1 85fd47e439588b9c25090a0b4e80708c70652403
- SHA512 c121ce2191dd3d934458ca89f7c2a9b533081e0675d1deaa703539b61424a3c47b8c2138bda3b31ecfcd05c520a5a23010e4c6d6b0e2d4c629ac76b22b163b26
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 6c59613b2be90b6d166603991f924210c4b644bf84a7a274d470ae02a2282602
- MD5 7f2ad78b5d1379f768dd3288afc4567d
- SHA1 617dd8d916b4700ba6eec05596ee356793fef5e2
- SHA512 5de1fcb8d1d8c33c4e4e4fa5a7f59a00136c5560c2ce5780508a2ef498465439d28405860e54bae4d052db8b3453d683891b527da1860607078a9818c2986ae3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 dcdf6ebb6217a515a75c9354229d03f3879e856ce876036ab387cb38f1ab3bbb
- MD5 a7cefd45e028a3f72535b620e5b80a6b
- SHA1 1c284484e61b0f5bc4139596946c5c903beb818e
- SHA512 ae75803d892a47e52e79d02c16e60c4a497f81c39d8c46ff45e051ccb7b773e5b4449ced1932ef4fdaac03b3962f8d697a49cf6c60b91a9647e5071d47fa17de
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Documents\EnterRead.doc.exe
- Size 512KB
- SHA256 94404f04a65a0bbfc46ed063169d3a446f0c55dd56e14fd71893a845ddb566a4
- MD5 ef76b969d853d13ff05b6e34fdd8daf8
- SHA1 dec1cf058bbeb6f917d92c829b0f43d7f752cfed
- SHA512 efbbbda8ba6a595d9320581baf48824f10bc2f03be3c6bf50b58d693cc08aa17e0337e9fd6671b6a0e6bffbd6bab9743c3d41515b73bec265fe074f25a305ff3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\krjklfpbfhzab.exe
- Size 512KB
- SHA256 72bfa82ab8ae3bf8a30a1940c975424a95da5f11c8bba9148ee87df605e769f4
- MD5 a96df8d1e9492bfa69b3d9e1eebd9eba
- SHA1 aeb798cebb70c8fb2303ea3094a92e0c82dc90ce
- SHA512 79a4d38c4404939c75ebb3bd98b0b2e042d7c8cafdbdd1eb03e5bc865665c05653a3787a8400574e8c86e08e87a68da8bc316a51eeebab9d50f670f7f90b4d49
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\kyuylzevqi.exe
- Size 512KB
- SHA256 fd17b26b0a9ff811e87513ffb303371999e22e9d60a47cbedf9df57d4975eb71
- MD5 d0725fd1a31a93a6da8e949f7f6926c6
- SHA1 030bb8b0ca68eded76cee61a0fdc7696e5ad4a85
- SHA512 b1299c0e675d423e72c57feef38080d862e95329fe121cfe4c83674a707af8049fb22e497d8278060010cb0691ddaf31af2f4a000d3195bc90822590e0f52ef8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6b:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\oxcvztii.exe
- Size 512KB
- SHA256 0d4840f84e0a7a998647bd0dd869cc624ade1e70f1a9222762376a4ffe11fe2a
- MD5 f791d6b5f91d10ed1be40e5fba9611c9
- SHA1 47bd106c92dfc1ce3a0f03768855dd5c830dc1c2
- SHA512 39e68f398d11f777a8b78b3b92c3eee07b82c4bd505bb22c29e49c7cf8b8b752c80ef71d4ccbf2298b04638ab44ffc35ec23393cbd14a86777d41139f021f943
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\zxlxnximlqokmch.exe
- Size 512KB
- SHA256 8fd92ce000ed76869820dd2b0708d2621d55aad4901ad12804e4ce3ed701a297
- MD5 0baba69b03761e322a0b72743c7955c7
- SHA1 9260ba913e0ccb1eba87069c32652e776c8c2f78
- SHA512 252ba37a6ea0c0ec289526be258bb971383e8852bb4cdb60c3df00b7339b3d3fd2a6dcf12f45fb7a6b02af5f4f1081372e282a8e1a21e5b22d631e1202e3bf07
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 cd7b1545535a1e37e801bf5a394d295221090437a14de00a63c368644392d334
- MD5 66d05ac9f9b76b2574c77c118b0c0e37
- SHA1 685d081cee689c24c1fc84c7d1b3fe228488c5e1
- SHA512 ba7d66c64dd4149c70c34ccf35be6982d6fa570601113381a5bd459d2ad3ae0d24b26083d3c1c0350127736687d7b529b1d225608717756739f19c7a07d75eb8
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 e823fac43a20d5807ba758a9273d658bc81d5553824a1491d4d8917c9e4d9c99
- MD5 6a8e194283e4d36754f602611e1f56be
- SHA1 fdd23c253789b442bfd4249b01583e780d1c9039
- SHA512 95b868842b51f2512722d1f14cdc8e3e96b57056c7a2f1a1406340362ad5783e310a00529f2d04adcc500ce61c3c9673c0406dbd0db70b930bea8110c12b9abd
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5n
- MD5 SHA1 SHA512 SSDEEP