Analysis
-
max time kernel
176s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07-01-2024 19:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ac6e9cfd8e27ba1289c9b11f9405d2a2.exe
Resource
win7-20231215-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
ac6e9cfd8e27ba1289c9b11f9405d2a2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
ac6e9cfd8e27ba1289c9b11f9405d2a2.exe
-
Size
512KB
-
MD5
ac6e9cfd8e27ba1289c9b11f9405d2a2
-
SHA1
48fb4fe988be98ef3d14365cada22ae850f073cc
-
SHA256
8a5eb1194ce5b26c4ddb52a3fb8326bcdee8936527f9a03dd3d580e256b564ca
-
SHA512
8d57778823a8aec91d9393f681777d4906d63cd7731c2a2c342c105e25dc9e051fe2ca4a5c771c46263e0b7cabbbb3fea0b0d39b4d20168f431c475e04e907d1
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5n
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" wnemfukrbf.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wnemfukrbf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wnemfukrbf.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wnemfukrbf.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation ac6e9cfd8e27ba1289c9b11f9405d2a2.exe -
Executes dropped EXE 5 IoCs
pid Process 1400 wnemfukrbf.exe 3300 nvsdsnfgceiazwt.exe 636 lrljhwvo.exe 1696 jjvgjweqbdcpd.exe 3728 lrljhwvo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wnemfukrbf.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dkvelbmm = "wnemfukrbf.exe" nvsdsnfgceiazwt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iqfwrnpf = "nvsdsnfgceiazwt.exe" nvsdsnfgceiazwt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jjvgjweqbdcpd.exe" nvsdsnfgceiazwt.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: lrljhwvo.exe File opened (read-only) \??\b: lrljhwvo.exe File opened (read-only) \??\l: lrljhwvo.exe File opened (read-only) \??\t: lrljhwvo.exe File opened (read-only) \??\w: lrljhwvo.exe File opened (read-only) \??\z: lrljhwvo.exe File opened (read-only) \??\x: wnemfukrbf.exe File opened (read-only) \??\a: lrljhwvo.exe File opened (read-only) \??\b: wnemfukrbf.exe File opened (read-only) \??\j: wnemfukrbf.exe File opened (read-only) \??\w: wnemfukrbf.exe File opened (read-only) \??\h: lrljhwvo.exe File opened (read-only) \??\y: lrljhwvo.exe File opened (read-only) \??\n: lrljhwvo.exe File opened (read-only) \??\v: lrljhwvo.exe File opened (read-only) \??\s: lrljhwvo.exe File opened (read-only) \??\m: wnemfukrbf.exe File opened (read-only) \??\s: wnemfukrbf.exe File opened (read-only) \??\p: lrljhwvo.exe File opened (read-only) \??\e: lrljhwvo.exe File opened (read-only) \??\p: lrljhwvo.exe File opened (read-only) \??\n: lrljhwvo.exe File opened (read-only) \??\q: lrljhwvo.exe File opened (read-only) \??\m: lrljhwvo.exe File opened (read-only) \??\i: lrljhwvo.exe File opened (read-only) \??\h: wnemfukrbf.exe File opened (read-only) \??\l: lrljhwvo.exe File opened (read-only) \??\r: wnemfukrbf.exe File opened (read-only) \??\u: lrljhwvo.exe File opened (read-only) \??\v: lrljhwvo.exe File opened (read-only) \??\k: lrljhwvo.exe File opened (read-only) \??\k: wnemfukrbf.exe File opened (read-only) \??\y: lrljhwvo.exe File opened (read-only) \??\i: wnemfukrbf.exe File opened (read-only) \??\b: lrljhwvo.exe File opened (read-only) \??\g: lrljhwvo.exe File opened (read-only) \??\m: lrljhwvo.exe File opened (read-only) \??\s: lrljhwvo.exe File opened (read-only) \??\x: lrljhwvo.exe File opened (read-only) \??\a: lrljhwvo.exe File opened (read-only) \??\t: wnemfukrbf.exe File opened (read-only) \??\o: wnemfukrbf.exe File opened (read-only) \??\q: wnemfukrbf.exe File opened (read-only) \??\k: lrljhwvo.exe File opened (read-only) \??\z: lrljhwvo.exe File opened (read-only) \??\l: wnemfukrbf.exe File opened (read-only) \??\u: lrljhwvo.exe File opened (read-only) \??\y: wnemfukrbf.exe File opened (read-only) \??\j: lrljhwvo.exe File opened (read-only) \??\j: lrljhwvo.exe File opened (read-only) \??\q: lrljhwvo.exe File opened (read-only) \??\w: lrljhwvo.exe File opened (read-only) \??\n: wnemfukrbf.exe File opened (read-only) \??\p: wnemfukrbf.exe File opened (read-only) \??\u: wnemfukrbf.exe File opened (read-only) \??\o: lrljhwvo.exe File opened (read-only) \??\g: lrljhwvo.exe File opened (read-only) \??\r: lrljhwvo.exe File opened (read-only) \??\z: wnemfukrbf.exe File opened (read-only) \??\e: lrljhwvo.exe File opened (read-only) \??\r: lrljhwvo.exe File opened (read-only) \??\e: wnemfukrbf.exe File opened (read-only) \??\v: wnemfukrbf.exe File opened (read-only) \??\g: wnemfukrbf.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" wnemfukrbf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" wnemfukrbf.exe -
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1876-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0006000000023210-9.dat autoit_exe behavioral2/files/0x000600000002320e-18.dat autoit_exe behavioral2/files/0x000600000002320f-20.dat autoit_exe behavioral2/files/0x0006000000023211-31.dat autoit_exe behavioral2/files/0x0008000000023230-112.dat autoit_exe behavioral2/files/0x000b00000001e74e-118.dat autoit_exe behavioral2/files/0x000b00000001e74e-125.dat autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\lrljhwvo.exe ac6e9cfd8e27ba1289c9b11f9405d2a2.exe File created C:\Windows\SysWOW64\jjvgjweqbdcpd.exe ac6e9cfd8e27ba1289c9b11f9405d2a2.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll wnemfukrbf.exe File opened for modification C:\Windows\SysWOW64\wnemfukrbf.exe ac6e9cfd8e27ba1289c9b11f9405d2a2.exe File opened for modification C:\Windows\SysWOW64\nvsdsnfgceiazwt.exe ac6e9cfd8e27ba1289c9b11f9405d2a2.exe File opened for modification C:\Windows\SysWOW64\jjvgjweqbdcpd.exe ac6e9cfd8e27ba1289c9b11f9405d2a2.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lrljhwvo.exe File created C:\Windows\SysWOW64\wnemfukrbf.exe ac6e9cfd8e27ba1289c9b11f9405d2a2.exe File created C:\Windows\SysWOW64\lrljhwvo.exe ac6e9cfd8e27ba1289c9b11f9405d2a2.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lrljhwvo.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lrljhwvo.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe lrljhwvo.exe File created C:\Windows\SysWOW64\nvsdsnfgceiazwt.exe ac6e9cfd8e27ba1289c9b11f9405d2a2.exe -
Drops file in Program Files directory 20 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lrljhwvo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal lrljhwvo.exe File opened for modification \??\c:\Program Files\BackupClear.doc.exe lrljhwvo.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lrljhwvo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lrljhwvo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal lrljhwvo.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lrljhwvo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lrljhwvo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lrljhwvo.exe File created \??\c:\Program Files\BackupClear.doc.exe lrljhwvo.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lrljhwvo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lrljhwvo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lrljhwvo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lrljhwvo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal lrljhwvo.exe File opened for modification C:\Program Files\BackupClear.doc.exe lrljhwvo.exe File opened for modification C:\Program Files\BackupClear.nal lrljhwvo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe lrljhwvo.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal lrljhwvo.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe lrljhwvo.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf ac6e9cfd8e27ba1289c9b11f9405d2a2.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" wnemfukrbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf wnemfukrbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs wnemfukrbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" wnemfukrbf.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings ac6e9cfd8e27ba1289c9b11f9405d2a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32442C769C2C83526A4377D570562DDC7DF564DF" ac6e9cfd8e27ba1289c9b11f9405d2a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BC5FF1D21DDD27CD0D38A749167" ac6e9cfd8e27ba1289c9b11f9405d2a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" wnemfukrbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat wnemfukrbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" wnemfukrbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" wnemfukrbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg wnemfukrbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFBFF8D4F26856F9132D6207D90BC97E13059436744623ED790" ac6e9cfd8e27ba1289c9b11f9405d2a2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh wnemfukrbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc wnemfukrbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1849C70915E4DBC7B9BD7C93EC9E34CF" ac6e9cfd8e27ba1289c9b11f9405d2a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" wnemfukrbf.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes ac6e9cfd8e27ba1289c9b11f9405d2a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBF9C9FE11F1E284083B30869D3996B08C02F143610338E2C445E709D5" ac6e9cfd8e27ba1289c9b11f9405d2a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC7B02847E239E853BDB9D53393D7C9" ac6e9cfd8e27ba1289c9b11f9405d2a2.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1680 WINWORD.EXE 1680 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1400 wnemfukrbf.exe 1400 wnemfukrbf.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 1400 wnemfukrbf.exe 1400 wnemfukrbf.exe 1696 jjvgjweqbdcpd.exe 1400 wnemfukrbf.exe 1696 jjvgjweqbdcpd.exe 1400 wnemfukrbf.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 1400 wnemfukrbf.exe 1400 wnemfukrbf.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 1400 wnemfukrbf.exe 1400 wnemfukrbf.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 1400 wnemfukrbf.exe 1400 wnemfukrbf.exe 1400 wnemfukrbf.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 3728 lrljhwvo.exe 3728 lrljhwvo.exe 3728 lrljhwvo.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 3300 nvsdsnfgceiazwt.exe 1400 wnemfukrbf.exe 1400 wnemfukrbf.exe 1400 wnemfukrbf.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 636 lrljhwvo.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 1696 jjvgjweqbdcpd.exe 3728 lrljhwvo.exe 3728 lrljhwvo.exe 3728 lrljhwvo.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE 1680 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1400 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 93 PID 1876 wrote to memory of 1400 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 93 PID 1876 wrote to memory of 1400 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 93 PID 1876 wrote to memory of 3300 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 94 PID 1876 wrote to memory of 3300 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 94 PID 1876 wrote to memory of 3300 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 94 PID 1876 wrote to memory of 636 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 96 PID 1876 wrote to memory of 636 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 96 PID 1876 wrote to memory of 636 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 96 PID 1876 wrote to memory of 1696 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 95 PID 1876 wrote to memory of 1696 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 95 PID 1876 wrote to memory of 1696 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 95 PID 1876 wrote to memory of 1680 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 97 PID 1876 wrote to memory of 1680 1876 ac6e9cfd8e27ba1289c9b11f9405d2a2.exe 97 PID 1400 wrote to memory of 3728 1400 wnemfukrbf.exe 99 PID 1400 wrote to memory of 3728 1400 wnemfukrbf.exe 99 PID 1400 wrote to memory of 3728 1400 wnemfukrbf.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac6e9cfd8e27ba1289c9b11f9405d2a2.exe"C:\Users\Admin\AppData\Local\Temp\ac6e9cfd8e27ba1289c9b11f9405d2a2.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\wnemfukrbf.exewnemfukrbf.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\lrljhwvo.exeC:\Windows\system32\lrljhwvo.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3728
-
-
-
C:\Windows\SysWOW64\nvsdsnfgceiazwt.exenvsdsnfgceiazwt.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3300
-
-
C:\Windows\SysWOW64\jjvgjweqbdcpd.exejjvgjweqbdcpd.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1696
-
-
C:\Windows\SysWOW64\lrljhwvo.exelrljhwvo.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:636
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD517fb415d79f2b5eebaa5a6c475991bf3
SHA19b9a40c5a15aa04f05f9a8e1ecacca1e1f3a3e19
SHA256bca06799e50d73d8d457d9d18edfd31b143274e17253c552fd5ebdc0746ff61b
SHA5124f2b015195b8c39fadecfd74462ccb17207d92c9d16b307612f0b04e5e8806e703803b59d79cfcf185476a53240ed97515cf8fd903b856398324176120fd8997
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD549034b9d502cd61e6259393c4d9a2dee
SHA1fe723b597ac95e1a5fb04a4288e13d65e28af0ac
SHA2560d58446742922f9c532820dbf62a5f962b9b68f6d600db8ac5b4fc7da3d2334a
SHA5128dbad4c5b8297c1a18634996a84961e79d68cc2adc9985dea1124636258265dd6c34f9df978c31cb40fbb82b31fed9c610ae164cbe0bfec4141e748f021a8df5
-
Filesize
512KB
MD53cd7c4d477189b5cc0ac477d76471bcd
SHA1f1bc57e5dc10ca02ae42d550edcf4c38a217f6a3
SHA25699cd6eb13ac97d2390cbf4418690af3b7546b406ee25414b3e5be0976611ac42
SHA5120c1c733c1454dcb9fcbd0c2e16613c677a6136a5d7035b4d4b44f95fbde81679d230edd2ebdcebfdb7c8a556366ff316e5a6cfab47c1a5b7924f4076ec95c18b
-
Filesize
512KB
MD54c6762d6e3717725bff5159af2d5418c
SHA198907213c2a1aab38967b5b4371c3aaccdafd304
SHA256682736182a81046417b5cd6bb49aa37d868b6b47dd96c1eabfd88565bc089679
SHA5125c6000066ec7f697cd9c71a7ac6de5277baaf51e059d301bada4b8a063607fa43919836786d47b21f28993fd47ce02ac7947556680682eb5dac8fe33b05b1051
-
Filesize
512KB
MD51dfd81358b6df8f25047d66bbb45f685
SHA1c753ddd5a790940950d363987f5882b1ac54ae79
SHA25671978026505d9c10e1866cecd46ea930d3f25b6a0ffc9af80db70d2ae1e47a23
SHA512f5f2c11a57acd42e301b8e80c379d87fa1547479c58f50ef9d438349c6b248e5ef35e951ee72612127642caca888776509c7b83cb8bdbe6ed4c8bdfb7a42074f
-
Filesize
512KB
MD518f8cfe38037450c38defd34b6513063
SHA1bf634196fabe7b120ec147d5108eeff2ee1d372e
SHA256f6f34a1b06f65677eb6638ddbcbff657d72e926e0afb49b832cfd391cc41705e
SHA51236a33eaa97c853effde4cbe2c7147b85fce19a04b669eb48a61722462374c1ace6f139ef57b718664943d7ac73edfc79d3acf5224f9ceafd7013a478500a3ca9
-
Filesize
512KB
MD5ba5c4ff91c8c1b5d96927b2d923afc7b
SHA18135b328dac351b17e6569b5c1e844bd6560d071
SHA25656490c80c1a414e47aeaa28ad155b9520dc225c0776b0615f14d6446face4051
SHA512c5d296108162295fb389c9415389424444b07a2dbfdf665687d0a1d376f7230f32f30f30ba209573319e3d5cde6400cfe5f171e33d50fae5d593ac93993d3788
-
Filesize
512KB
MD5b73f1fafe9ded372de69ea28296ea81e
SHA12565519dfb73f8c9dd655406f64084457a0d3705
SHA256de48634ab5a606846b156978e5cf6b42e22043ae00bf627bf88ea212d69e9ead
SHA5128dd0fa25c30a74965b930b027b94c597e6e352c79b7b73f688b124ed86a9a27f6418ca4987add2c08d7f2d0e7905edb0302239ed38bd0375c22837331d48af26
-
Filesize
512KB
MD55b030d45da0422cc543f2296f7c01835
SHA1e8a5604994f7850412b9f06b063ac77f25c240ab
SHA2563c166910627d18f8c1da1cc2167673c8746c409656aa7914434dfaefe1add864
SHA51273574ac93c9713213e8e6b3a1dfc03be7e44111722158f108044dc9413d02ca02f92f58fa62ce65019c5859fece6088b371eace47d4d41e8c200c1e4da9b929d