Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2024, 04:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4a6678d81f3491f723768af898ee5a2f.exe
Resource
win7-20231129-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a6678d81f3491f723768af898ee5a2f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 4a6678d81f3491f723768af898ee5a2f.exe
- Size 512KB
- Sample240108-eqjacaaghk
- SHA256 48f7e7ff1682c123e82f0f3040f54e01066f3624290dd3e77bfee6655144caf4
- MD5 4a6678d81f3491f723768af898ee5a2f
- SHA1 a660ec05144213838bf202fc23a6958ec35d5112
- SHA512 2daeeb6215218853788b4128ce11a19497aca9e99f30422259f09317782e4639541f3010c7e25b5fe23327e28b9620099ee752e7e2cb2127720d383179adbf15
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6w:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ruwjruhkji.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ruwjruhkji.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ruwjruhkji.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ruwjruhkji.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 4a6678d81f3491f723768af898ee5a2f.exe - Executes dropped EXE 5 IoCs
pid Process 444 ruwjruhkji.exe 2676 mzbnjucpwpbrjhw.exe 2768 hsnzhztulucnv.exe 3664 dchutkco.exe 3984 dchutkco.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ruwjruhkji.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fvtxbpwx = "ruwjruhkji.exe" mzbnjucpwpbrjhw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lemeizyc = "mzbnjucpwpbrjhw.exe" mzbnjucpwpbrjhw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "hsnzhztulucnv.exe" mzbnjucpwpbrjhw.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: ruwjruhkji.exe File opened (read-only) \??\x: ruwjruhkji.exe File opened (read-only) \??\e: dchutkco.exe File opened (read-only) \??\h: dchutkco.exe File opened (read-only) \??\n: dchutkco.exe File opened (read-only) \??\z: dchutkco.exe File opened (read-only) \??\a: dchutkco.exe File opened (read-only) \??\g: dchutkco.exe File opened (read-only) \??\i: dchutkco.exe File opened (read-only) \??\a: dchutkco.exe File opened (read-only) \??\u: dchutkco.exe File opened (read-only) \??\s: dchutkco.exe File opened (read-only) \??\r: dchutkco.exe File opened (read-only) \??\t: dchutkco.exe File opened (read-only) \??\x: dchutkco.exe File opened (read-only) \??\o: ruwjruhkji.exe File opened (read-only) \??\u: ruwjruhkji.exe File opened (read-only) \??\e: dchutkco.exe File opened (read-only) \??\s: ruwjruhkji.exe File opened (read-only) \??\i: dchutkco.exe File opened (read-only) \??\o: dchutkco.exe File opened (read-only) \??\r: ruwjruhkji.exe File opened (read-only) \??\v: ruwjruhkji.exe File opened (read-only) \??\w: ruwjruhkji.exe File opened (read-only) \??\x: dchutkco.exe File opened (read-only) \??\b: dchutkco.exe File opened (read-only) \??\v: dchutkco.exe File opened (read-only) \??\b: ruwjruhkji.exe File opened (read-only) \??\k: dchutkco.exe File opened (read-only) \??\t: ruwjruhkji.exe File opened (read-only) \??\z: ruwjruhkji.exe File opened (read-only) \??\g: dchutkco.exe File opened (read-only) \??\o: dchutkco.exe File opened (read-only) \??\h: dchutkco.exe File opened (read-only) \??\m: dchutkco.exe File opened (read-only) \??\p: dchutkco.exe File opened (read-only) \??\u: dchutkco.exe File opened (read-only) \??\p: ruwjruhkji.exe File opened (read-only) \??\w: dchutkco.exe File opened (read-only) \??\y: dchutkco.exe File opened (read-only) \??\n: dchutkco.exe File opened (read-only) \??\g: ruwjruhkji.exe File opened (read-only) \??\i: ruwjruhkji.exe File opened (read-only) \??\j: dchutkco.exe File opened (read-only) \??\k: dchutkco.exe File opened (read-only) \??\s: dchutkco.exe File opened (read-only) \??\l: dchutkco.exe File opened (read-only) \??\r: dchutkco.exe File opened (read-only) \??\y: ruwjruhkji.exe File opened (read-only) \??\b: dchutkco.exe File opened (read-only) \??\j: dchutkco.exe File opened (read-only) \??\v: dchutkco.exe File opened (read-only) \??\z: dchutkco.exe File opened (read-only) \??\q: dchutkco.exe File opened (read-only) \??\t: dchutkco.exe File opened (read-only) \??\w: dchutkco.exe File opened (read-only) \??\q: dchutkco.exe File opened (read-only) \??\j: ruwjruhkji.exe File opened (read-only) \??\k: ruwjruhkji.exe File opened (read-only) \??\q: ruwjruhkji.exe File opened (read-only) \??\m: dchutkco.exe File opened (read-only) \??\l: dchutkco.exe File opened (read-only) \??\h: ruwjruhkji.exe File opened (read-only) \??\n: ruwjruhkji.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ruwjruhkji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ruwjruhkji.exe - AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3980-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x00090000000231f0-5.dat autoit_exe behavioral2/files/0x001100000002314c-18.dat autoit_exe behavioral2/files/0x001100000002314c-19.dat autoit_exe behavioral2/files/0x00090000000231f0-23.dat autoit_exe behavioral2/files/0x00070000000231f6-29.dat autoit_exe behavioral2/files/0x00070000000231f5-32.dat autoit_exe behavioral2/files/0x00070000000231f5-31.dat autoit_exe behavioral2/files/0x00070000000231f6-28.dat autoit_exe behavioral2/files/0x00090000000231f0-22.dat autoit_exe behavioral2/files/0x00070000000231f5-44.dat autoit_exe behavioral2/files/0x000600000002321b-75.dat autoit_exe behavioral2/files/0x000600000002321a-72.dat autoit_exe behavioral2/files/0x000a00000001d8b4-84.dat autoit_exe behavioral2/files/0x000600000002321d-91.dat autoit_exe behavioral2/files/0x000600000002321d-100.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\ruwjruhkji.exe 4a6678d81f3491f723768af898ee5a2f.exe File opened for modification C:\Windows\SysWOW64\dchutkco.exe 4a6678d81f3491f723768af898ee5a2f.exe File opened for modification C:\Windows\SysWOW64\hsnzhztulucnv.exe 4a6678d81f3491f723768af898ee5a2f.exe File opened for modification C:\Windows\SysWOW64\mzbnjucpwpbrjhw.exe 4a6678d81f3491f723768af898ee5a2f.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dchutkco.exe File created C:\Windows\SysWOW64\mzbnjucpwpbrjhw.exe 4a6678d81f3491f723768af898ee5a2f.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification C:\Windows\SysWOW64\ruwjruhkji.exe 4a6678d81f3491f723768af898ee5a2f.exe File created C:\Windows\SysWOW64\dchutkco.exe 4a6678d81f3491f723768af898ee5a2f.exe File created C:\Windows\SysWOW64\hsnzhztulucnv.exe 4a6678d81f3491f723768af898ee5a2f.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ruwjruhkji.exe - Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dchutkco.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dchutkco.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dchutkco.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dchutkco.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal dchutkco.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dchutkco.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal dchutkco.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dchutkco.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal dchutkco.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal dchutkco.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dchutkco.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dchutkco.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dchutkco.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dchutkco.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dchutkco.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dchutkco.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification C:\Windows\mydoc.rtf 4a6678d81f3491f723768af898ee5a2f.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dchutkco.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dchutkco.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dchutkco.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dchutkco.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dchutkco.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dchutkco.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dchutkco.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dchutkco.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32412D7D9D5583556D3E77D5702E2CAE7D8464AB" 4a6678d81f3491f723768af898ee5a2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB8F9BEF916F197837A3A4486983E91B388038D4311023BE1C442E809D4" 4a6678d81f3491f723768af898ee5a2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB0B12947E6389852CABAA032EFD7C9" 4a6678d81f3491f723768af898ee5a2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F768B3FF1B22D0D272D1D58B7E9062" 4a6678d81f3491f723768af898ee5a2f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ruwjruhkji.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 4a6678d81f3491f723768af898ee5a2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ruwjruhkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ruwjruhkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ruwjruhkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF9FCFF482E821B9130D62D7E91BC93E147584267446330D6E9" 4a6678d81f3491f723768af898ee5a2f.exe Key created \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000_Classes\Local Settings 4a6678d81f3491f723768af898ee5a2f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ruwjruhkji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ruwjruhkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ruwjruhkji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ruwjruhkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC6741594DABEB8CD7F97EC9734CA" 4a6678d81f3491f723768af898ee5a2f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ruwjruhkji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ruwjruhkji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ruwjruhkji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ruwjruhkji.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2568 WINWORD.EXE 2568 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 2676 mzbnjucpwpbrjhw.exe 2768 hsnzhztulucnv.exe 2676 mzbnjucpwpbrjhw.exe 2676 mzbnjucpwpbrjhw.exe 2676 mzbnjucpwpbrjhw.exe 2768 hsnzhztulucnv.exe 2676 mzbnjucpwpbrjhw.exe 2676 mzbnjucpwpbrjhw.exe 2676 mzbnjucpwpbrjhw.exe 2676 mzbnjucpwpbrjhw.exe 2768 hsnzhztulucnv.exe 2768 hsnzhztulucnv.exe 2768 hsnzhztulucnv.exe 2768 hsnzhztulucnv.exe 2768 hsnzhztulucnv.exe 2768 hsnzhztulucnv.exe 2768 hsnzhztulucnv.exe 2768 hsnzhztulucnv.exe 2768 hsnzhztulucnv.exe 2768 hsnzhztulucnv.exe 2676 mzbnjucpwpbrjhw.exe 2676 mzbnjucpwpbrjhw.exe 3664 dchutkco.exe 3664 dchutkco.exe 3664 dchutkco.exe 3664 dchutkco.exe 3664 dchutkco.exe 3664 dchutkco.exe 3664 dchutkco.exe 3664 dchutkco.exe 444 ruwjruhkji.exe 444 ruwjruhkji.exe 444 ruwjruhkji.exe 444 ruwjruhkji.exe 444 ruwjruhkji.exe 444 ruwjruhkji.exe 444 ruwjruhkji.exe 444 ruwjruhkji.exe 444 ruwjruhkji.exe 444 ruwjruhkji.exe 2676 mzbnjucpwpbrjhw.exe 2676 mzbnjucpwpbrjhw.exe 3984 dchutkco.exe 3984 dchutkco.exe 3984 dchutkco.exe 3984 dchutkco.exe 3984 dchutkco.exe 3984 dchutkco.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 444 ruwjruhkji.exe 2768 hsnzhztulucnv.exe 444 ruwjruhkji.exe 2676 mzbnjucpwpbrjhw.exe 2768 hsnzhztulucnv.exe 444 ruwjruhkji.exe 2676 mzbnjucpwpbrjhw.exe 2768 hsnzhztulucnv.exe 3664 dchutkco.exe 2676 mzbnjucpwpbrjhw.exe 3664 dchutkco.exe 3664 dchutkco.exe 3984 dchutkco.exe 3984 dchutkco.exe 3984 dchutkco.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 3980 4a6678d81f3491f723768af898ee5a2f.exe 444 ruwjruhkji.exe 2768 hsnzhztulucnv.exe 444 ruwjruhkji.exe 2676 mzbnjucpwpbrjhw.exe 2768 hsnzhztulucnv.exe 444 ruwjruhkji.exe 2676 mzbnjucpwpbrjhw.exe 2768 hsnzhztulucnv.exe 2676 mzbnjucpwpbrjhw.exe 3664 dchutkco.exe 3664 dchutkco.exe 3664 dchutkco.exe 3984 dchutkco.exe 3984 dchutkco.exe 3984 dchutkco.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2568 WINWORD.EXE 2568 WINWORD.EXE 2568 WINWORD.EXE 2568 WINWORD.EXE 2568 WINWORD.EXE 2568 WINWORD.EXE 2568 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3980 wrote to memory of 444 3980 4a6678d81f3491f723768af898ee5a2f.exe 88 PID 3980 wrote to memory of 444 3980 4a6678d81f3491f723768af898ee5a2f.exe 88 PID 3980 wrote to memory of 444 3980 4a6678d81f3491f723768af898ee5a2f.exe 88 PID 3980 wrote to memory of 2676 3980 4a6678d81f3491f723768af898ee5a2f.exe 89 PID 3980 wrote to memory of 2676 3980 4a6678d81f3491f723768af898ee5a2f.exe 89 PID 3980 wrote to memory of 2676 3980 4a6678d81f3491f723768af898ee5a2f.exe 89 PID 3980 wrote to memory of 3664 3980 4a6678d81f3491f723768af898ee5a2f.exe 91 PID 3980 wrote to memory of 3664 3980 4a6678d81f3491f723768af898ee5a2f.exe 91 PID 3980 wrote to memory of 3664 3980 4a6678d81f3491f723768af898ee5a2f.exe 91 PID 3980 wrote to memory of 2768 3980 4a6678d81f3491f723768af898ee5a2f.exe 90 PID 3980 wrote to memory of 2768 3980 4a6678d81f3491f723768af898ee5a2f.exe 90 PID 3980 wrote to memory of 2768 3980 4a6678d81f3491f723768af898ee5a2f.exe 90 PID 3980 wrote to memory of 2568 3980 4a6678d81f3491f723768af898ee5a2f.exe 92 PID 3980 wrote to memory of 2568 3980 4a6678d81f3491f723768af898ee5a2f.exe 92 PID 444 wrote to memory of 3984 444 ruwjruhkji.exe 95 PID 444 wrote to memory of 3984 444 ruwjruhkji.exe 95 PID 444 wrote to memory of 3984 444 ruwjruhkji.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a6678d81f3491f723768af898ee5a2f.exe"C:\Users\Admin\AppData\Local\Temp\4a6678d81f3491f723768af898ee5a2f.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\ruwjruhkji.exeruwjruhkji.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SysWOW64\dchutkco.exeC:\Windows\system32\dchutkco.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3984
-
-
-
C:\Windows\SysWOW64\mzbnjucpwpbrjhw.exemzbnjucpwpbrjhw.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2676
-
-
C:\Windows\SysWOW64\hsnzhztulucnv.exehsnzhztulucnv.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2768
-
-
C:\Windows\SysWOW64\dchutkco.exedchutkco.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3664
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2568
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 112KB
- SHA256 bb1fb6a5eec7c293ac891f8daf4563d7dd62abce6bc955ec1a62b5d60d7447b3
- MD5 642e5be3bf5c1c241d422bcaccf9cd95
- SHA1 700d8912e2dc3bfb0abcce88f3c70f0bc3bf6a2d
- SHA512 030494f51b3818b93cb8cf065dea0eadfa64d7d1e8a6e8d542f1df938331ddb43d16ce4a0f5cd50a8061366f170948d33a382a09df6e13ac37d1838f1ca2910a
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/B22:1VY0W0sVVZ/dkq5BCoFaJ22
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 71KB
- SHA256 1d0f65bbd4c841d4f57a92baa48c997f5ec468e2cb03bcef5e9ef01f79f02464
- MD5 4dfe0d8f13513fc06cae4cbad64633c3
- SHA1 bd8416532cc0bd9dbda95b16dc3e42f3e0338b06
- SHA512 cce0f4c6977f3c95924bfccefdb1209949a45c47816119e940a8f2ddc734ee4d228d49104473808820d12541d0a18200b2b37cb2e68791f8b98b22584303e1e4
- SSDEEP 1536:1VY0W0/xYGG2BIUuR1v7hvFPRVaai49TRIKl/75k3Jeu0Fyg4nJOWkkOBC3n:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC3n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 9def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
- MD5 12b138a5a40ffb88d1850866bf2959cd
- SHA1 57001ba2de61329118440de3e9f8a81074cb28a2
- SHA512 9f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 e264a394646a45d7346f1e75089d4b3209407979c2c27c5b23d765696a45ab34
- MD5 8c0e536b431e68ab803eaf649a809cdf
- SHA1 c46a33538624ac4b862ed76dd3bd5610d4b6360e
- SHA512 48d9c186de11ff45261d8f8f9a26d10189e26420ee2fd97a448ccc0b00b4565b9aeed9b1ba3f48de3ed06560c2cd9f54fdf3efbc741691620dc449f5df330243
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 cec1559523961ed93f1e5e382e6e042ae245e4ec96647d78ee8fb5f473cb0aba
- MD5 c155be9f48fdf3a26d69265ffcd8c24b
- SHA1 c992a779a5f241d1284857c6ed3eed639bd1177c
- SHA512 360f5de7eb63460260902223761010fc04015b1e8a3cda33d8c2c01a2a201eaf7e01ad34aa4ef38a995d37b911f7696ba6503430b2f14c85bc23f4176c644a9b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Desktop\ConnectDisable.doc.exe
- Size 214KB
- SHA256 8652f821a92dd101ba8ab7502c1ac249b0260b1a0e7a1aaa16e8833ca9b75849
- MD5 a3685f5ed369253718ed8ed8c059f922
- SHA1 44d16714cb91115689deb972adbb3100c9795845
- SHA512 4a0371de03cb517662063d4179fda43ccda95ad1149dbf8294377682a4136f108ffa357c056662ae7e32c565aed101cf8feacd18275225c1ab2f74bf412d023f
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTL:1gDhdkq5BCoC5LfWSLTL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\dchutkco.exe
- Size 56KB
- SHA256 a73168e9ef6049c2050aaa8d45ff10f75f7be746d068382542d4448ad2318c83
- MD5 e167340476bc2db7662888e4ba7481c5
- SHA1 668dd203ac6b008f883f94696878e358c120029f
- SHA512 55c9109de2322db100778d709df23a784349a4139d2b7d04a7d90c606af43ba6096afd3adbfae42191534c32b821ffaa11020abf7f29fb8b048dd8aa143b720d
- SSDEEP 1536:1VY0W0/xYGG2BIUuR1v7hvFPRVaai49TRIKl/75k3Jek:1VY0W0/2RbBxRVaaNRR/dkAk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\dchutkco.exe
- Size 43KB
- SHA256 d6b2257308d98cd0a2115c6f748dd6ca10c0951bf517b007ed2f1789c96c7165
- MD5 ce1bd1f115dd309b5db2b9ee518bcbc6
- SHA1 f0c9acfd14a19ce58f4865a7efdf75d13bfb02db
- SHA512 d9c114f361d63bebd4c25de4bf9ee4bb432a5437fd9ace9c8f312992cc341edda9847470fb7483970cfdf5975db7d4ff08d65305666844fda30adcf6d7c51701
- SSDEEP 768:1PdereW0W0i9IVRnxC7GG2Bx4SmUmpxP1v7h8yFCp4XrNeNoawMSi4tHTTf6OHug:1VY0W0/xYGG2BIUuR1v7hvFPRVaai49t
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\dchutkco.exe
- Size 81KB
- SHA256 3b68edccbd610031775bdfea5460bd830f29fef8a1a442b6a04852e9ee404188
- MD5 1cd04bf27d412f4ed53868a5b4e8c894
- SHA1 09d47ef8fc9c4fc0481c6781f47ed75249268e76
- SHA512 e9fb3b2be1d40abf3f50eac0ecda911ca24c89fcd7b305753032bb73c0de63d1f887793886db1e6cc51d17346edb66f6aea3ad9d5e1e9d6dbb288b2b2293c759
- SSDEEP 1536:1VY0W0/xYGG2BIUuR1v7hvFPRVaai49TRIKl/75k3Jeu0Fyg4nJOWkkOBC3nh/45:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC31m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\hsnzhztulucnv.exe
- Size 107KB
- SHA256 d0c4f3c0ba92bfc91c158cfffa3ae31ae97a0b5cee906056c71a830990ee7026
- MD5 8f1bc1a8ce5948985f378561181281ff
- SHA1 9a53fb82388f68ea2919f89d300f06880d09e6f0
- SHA512 329ab8d82fc7d56b6e7ad71fab52338d04955a9cc92207f1a036eb3948c89cb1cd1cab7aea82decb45fbee55ff7de1b8a776369e447f9ca8b3ea14c93b975fe6
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/BN:1VY0W0sVVZ/dkq5BCoFaJN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\hsnzhztulucnv.exe
- Size 142KB
- SHA256 57ea214fc1cce9b9306a8fb5342dbffcc7258bb59f50f800b2245b3878790bba
- MD5 8adcaf96adadc548bb43dba5ae53a4e0
- SHA1 7f6dd737c1826565e0757b6d2d1fba91b1ce0635
- SHA512 71e86aea441e6b81de9c1a59db811fb8d13c4099f3fcf7a6653b9c9f2b618d7597146a5762b833fc0f41e6668ac6eaff66956e58ba58c074604a7d2c0955e333
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/B2i5L4SzV/oIlAg19:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf2k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mzbnjucpwpbrjhw.exe
- Size 135KB
- SHA256 d76819818d2f1f439952fbe751409faf83e2ab9d686d3cb8416d14f10fab7e74
- MD5 053e580874769d567c0c9a179468df73
- SHA1 07a5a4301d673e760ff40fbce83a7b7adebd35b2
- SHA512 e424483ed481b52317e109caff0879b76239204a95eeab3ab15cc8c9d979e30eb2a4c9d99dc12bbbe51aafb1f4f85ac15fcbed7ed891838bac7dc758eb79cfcd
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/B2i5L4SzV/oIlAg1E:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf2l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mzbnjucpwpbrjhw.exe
- Size 86KB
- SHA256 cc1157ce648d8489e44dbea2725630b3f7707e6129cce6f681073f3a5502fdef
- MD5 552e353d524fda09fe43845629f850b8
- SHA1 53949c007e0b35e06026a763c18ef0c34a7a478a
- SHA512 d69c7515d2178c4fcd5b59ae552a902b0e1c12ed15f0c1c0c45bed96a38e31fa1692d70662d55630f711c19b1dba3b24d407c7ab42e8e782be6c9b3dcdfedf20
- SSDEEP 1536:1VY0W0/xYGG2BIUuR1v7hvFPRVaai49TRIKl/75k3Jeu0Fyg4nJOWkkOBC3nh/4o:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC31h
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\mzbnjucpwpbrjhw.exe
- Size 189KB
- SHA256 712544163174edf5ba76bdddcbce4a073981382d5b0c789ad0740df6654ee289
- MD5 ebdd3c5f111862a75e24bd38f0faebac
- SHA1 2228f2e4c7c05f220c6069ee33f0242ce59b9271
- SHA512 52aa237e00b889c29b50ef626354fca50ead0e2567e9ea56bf27d4114a858538543f1a89cad6b2889b42157937b89afbf09df933d77005534f1fbdfe3246784b
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/B2i5L4SzV/oIlAg1RC6TCWS:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C078
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ruwjruhkji.exe
- Size 228KB
- SHA256 9db97f665aed12fd4695f216750d5b3787fdddeadc15744d2b0eecc342ecaa83
- MD5 18acb05dfc2d70c543327264589927e1
- SHA1 930b3d238fb87413c4b942652ddbca7f11d9345f
- SHA512 22654d3854a6fb3160b5e89b7196c8a8b8417f7ec5e0479cb027a9ffc7d9a43e5997ff1da3c077b68e4a7fb5331a6a2b06f078116a2f3682a07abc6d09da3c48
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUFd:1gDhdkq5BCoC5LfWSLTU3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ruwjruhkji.exe
- Size 69KB
- SHA256 d91fac344c7f77786db2871af2c27fb7b3125149ad684f5324f990abc9c5e92d
- MD5 769775f257c52f3937472222062cf5ef
- SHA1 24db70f10c9329470d5b0f38f743861d13cc00ea
- SHA512 561c1666effd349790fd249d88892cde4ac42c4726341bc055cbd2c1ab9825bc1a4a152c2968f556d2e9e25e85dc52f7f42a1865f600e7ba3033e95c5aa9de18
- SSDEEP 1536:1VY0W0/xYGG2BIUuR1v7hvFPRVaai49TRIKl/75k3Jeu0Fyg4nJOWkq:1VY0W0/2RbBxRVaaNRR/dkAiQq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 206KB
- SHA256 3b56e8d41853dce2de3359f003c7522b776f74ac2cbfa0d2b855da0aedaa6e74
- MD5 edc1540dbd37e18355c5816a42f4ea7e
- SHA1 7df4ce8523371701f984c581116a337ba462e805
- SHA512 ed2123e22660514d596debc391c5224831393f09ebbbcbb4c856eb3e0a6e60e11dcf4671188a23c25cd1326258d5d322fa7fe48631924f7097a04eac3501fee1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSL9:1gDhdkq5BCoC5LfWSL9
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 1KB
- SHA256 87b17909878537f2c3d3bc046f54b9eb382e312fa75d2b177457a978dcc7d83c
- MD5 ec89629d437c17787acc7061c89e753c
- SHA1 c65089b32eba1cf75d3546335718073460c971f9
- SHA512 65f02cc30b64e2c33d7287c135bc0bb20abe1e35c7176a03e47403db3e21da28f7e7ec7a13ef748aeb76ac06e5e159a9b4e62196692c3411459a4ae235a1bec9
- MD5 SHA1 SHA512