Analysis
-
max time kernel
165s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 05:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
73e013693da5ed75f739f5bfe74ed2d9.exe
Resource
win7-20231215-en
windows7-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
73e013693da5ed75f739f5bfe74ed2d9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
25 signatures
150 seconds
General
-
Target
73e013693da5ed75f739f5bfe74ed2d9.exe
-
Size
512KB
-
MD5
73e013693da5ed75f739f5bfe74ed2d9
-
SHA1
f5dd4fdda13caaac465dd4060899dc9998d3c775
-
SHA256
0c070654787fce6f1e05cc54c6a382bacbdb2b032ed07cf6ff39296bb4258476
-
SHA512
e56ab96313aaf4bcc6dfef6c096e2f2c60bf037f3ce6a5469b3e8675287b3b1a144ec32a4dad7fe96e769b5568310b2bb997a25ee4f0eabfdc89f2c21e9b23e5
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" wjeqxeseih.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wjeqxeseih.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wjeqxeseih.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wjeqxeseih.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 73e013693da5ed75f739f5bfe74ed2d9.exe -
Executes dropped EXE 5 IoCs
pid Process 4360 wjeqxeseih.exe 2608 gkeyjctjxsposgp.exe 1208 hbseozds.exe 3420 acsewkkdhydwf.exe 1860 hbseozds.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" wjeqxeseih.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hytxcmhg = "gkeyjctjxsposgp.exe" gkeyjctjxsposgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "acsewkkdhydwf.exe" gkeyjctjxsposgp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sdkuqlvt = "wjeqxeseih.exe" gkeyjctjxsposgp.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: hbseozds.exe File opened (read-only) \??\x: hbseozds.exe File opened (read-only) \??\y: wjeqxeseih.exe File opened (read-only) \??\o: hbseozds.exe File opened (read-only) \??\i: hbseozds.exe File opened (read-only) \??\r: hbseozds.exe File opened (read-only) \??\r: wjeqxeseih.exe File opened (read-only) \??\k: hbseozds.exe File opened (read-only) \??\m: hbseozds.exe File opened (read-only) \??\g: hbseozds.exe File opened (read-only) \??\h: hbseozds.exe File opened (read-only) \??\n: hbseozds.exe File opened (read-only) \??\e: wjeqxeseih.exe File opened (read-only) \??\l: wjeqxeseih.exe File opened (read-only) \??\n: wjeqxeseih.exe File opened (read-only) \??\l: hbseozds.exe File opened (read-only) \??\a: hbseozds.exe File opened (read-only) \??\s: wjeqxeseih.exe File opened (read-only) \??\e: hbseozds.exe File opened (read-only) \??\i: hbseozds.exe File opened (read-only) \??\u: hbseozds.exe File opened (read-only) \??\w: hbseozds.exe File opened (read-only) \??\z: hbseozds.exe File opened (read-only) \??\b: wjeqxeseih.exe File opened (read-only) \??\h: wjeqxeseih.exe File opened (read-only) \??\i: wjeqxeseih.exe File opened (read-only) \??\x: wjeqxeseih.exe File opened (read-only) \??\b: hbseozds.exe File opened (read-only) \??\l: hbseozds.exe File opened (read-only) \??\g: wjeqxeseih.exe File opened (read-only) \??\t: hbseozds.exe File opened (read-only) \??\q: wjeqxeseih.exe File opened (read-only) \??\t: wjeqxeseih.exe File opened (read-only) \??\a: wjeqxeseih.exe File opened (read-only) \??\m: wjeqxeseih.exe File opened (read-only) \??\o: wjeqxeseih.exe File opened (read-only) \??\a: hbseozds.exe File opened (read-only) \??\b: hbseozds.exe File opened (read-only) \??\s: hbseozds.exe File opened (read-only) \??\w: hbseozds.exe File opened (read-only) \??\x: hbseozds.exe File opened (read-only) \??\z: hbseozds.exe File opened (read-only) \??\t: hbseozds.exe File opened (read-only) \??\e: hbseozds.exe File opened (read-only) \??\p: hbseozds.exe File opened (read-only) \??\g: hbseozds.exe File opened (read-only) \??\y: hbseozds.exe File opened (read-only) \??\j: hbseozds.exe File opened (read-only) \??\k: wjeqxeseih.exe File opened (read-only) \??\v: wjeqxeseih.exe File opened (read-only) \??\z: wjeqxeseih.exe File opened (read-only) \??\u: hbseozds.exe File opened (read-only) \??\v: hbseozds.exe File opened (read-only) \??\o: hbseozds.exe File opened (read-only) \??\s: hbseozds.exe File opened (read-only) \??\p: wjeqxeseih.exe File opened (read-only) \??\u: wjeqxeseih.exe File opened (read-only) \??\w: wjeqxeseih.exe File opened (read-only) \??\h: hbseozds.exe File opened (read-only) \??\j: hbseozds.exe File opened (read-only) \??\n: hbseozds.exe File opened (read-only) \??\m: hbseozds.exe File opened (read-only) \??\y: hbseozds.exe File opened (read-only) \??\k: hbseozds.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" wjeqxeseih.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" wjeqxeseih.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4996-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0002000000022775-8.dat autoit_exe behavioral2/files/0x0009000000022480-18.dat autoit_exe behavioral2/files/0x000a00000002301b-26.dat autoit_exe behavioral2/files/0x000a00000002301f-32.dat autoit_exe behavioral2/files/0x0017000000018133-69.dat autoit_exe behavioral2/files/0x0008000000009f84-64.dat autoit_exe behavioral2/files/0x0003000000000737-129.dat autoit_exe behavioral2/files/0x0003000000000737-134.dat autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\hbseozds.exe 73e013693da5ed75f739f5bfe74ed2d9.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe hbseozds.exe File opened for modification C:\Windows\SysWOW64\acsewkkdhydwf.exe 73e013693da5ed75f739f5bfe74ed2d9.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe hbseozds.exe File opened for modification C:\Windows\SysWOW64\wjeqxeseih.exe 73e013693da5ed75f739f5bfe74ed2d9.exe File created C:\Windows\SysWOW64\acsewkkdhydwf.exe 73e013693da5ed75f739f5bfe74ed2d9.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe hbseozds.exe File created C:\Windows\SysWOW64\gkeyjctjxsposgp.exe 73e013693da5ed75f739f5bfe74ed2d9.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe hbseozds.exe File opened for modification C:\Windows\SysWOW64\hbseozds.exe 73e013693da5ed75f739f5bfe74ed2d9.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll wjeqxeseih.exe File created C:\Windows\SysWOW64\wjeqxeseih.exe 73e013693da5ed75f739f5bfe74ed2d9.exe File opened for modification C:\Windows\SysWOW64\gkeyjctjxsposgp.exe 73e013693da5ed75f739f5bfe74ed2d9.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hbseozds.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hbseozds.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal hbseozds.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hbseozds.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal hbseozds.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal hbseozds.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hbseozds.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hbseozds.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe hbseozds.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hbseozds.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hbseozds.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal hbseozds.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hbseozds.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hbseozds.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe hbseozds.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 73e013693da5ed75f739f5bfe74ed2d9.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC3B1284494399853B8B9A732EAD4C5" 73e013693da5ed75f739f5bfe74ed2d9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C77814E6DBB3B8BE7CE9ED9634CE" 73e013693da5ed75f739f5bfe74ed2d9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc wjeqxeseih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf wjeqxeseih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" wjeqxeseih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" wjeqxeseih.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 73e013693da5ed75f739f5bfe74ed2d9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" wjeqxeseih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh wjeqxeseih.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings 73e013693da5ed75f739f5bfe74ed2d9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat wjeqxeseih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E89FFFF4F5A856D9046D72C7DE5BD90E143583767436242D7E9" 73e013693da5ed75f739f5bfe74ed2d9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F26BB1FE6F22DDD108D0A28B7F9011" 73e013693da5ed75f739f5bfe74ed2d9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" wjeqxeseih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" wjeqxeseih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" wjeqxeseih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC9FABFF913F290837A3B42819F39E2B3FE038C42680349E2CD42E709D1" 73e013693da5ed75f739f5bfe74ed2d9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs wjeqxeseih.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg wjeqxeseih.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32442C0D9C2C82276D3476D577252CDB7D8764A8" 73e013693da5ed75f739f5bfe74ed2d9.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2940 WINWORD.EXE 2940 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 1208 hbseozds.exe 1208 hbseozds.exe 1208 hbseozds.exe 1208 hbseozds.exe 1208 hbseozds.exe 1208 hbseozds.exe 1208 hbseozds.exe 1208 hbseozds.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 2608 gkeyjctjxsposgp.exe 3420 acsewkkdhydwf.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 1208 hbseozds.exe 1208 hbseozds.exe 1208 hbseozds.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 1860 hbseozds.exe 1860 hbseozds.exe 1860 hbseozds.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 4360 wjeqxeseih.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 2608 gkeyjctjxsposgp.exe 1208 hbseozds.exe 1208 hbseozds.exe 1208 hbseozds.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 3420 acsewkkdhydwf.exe 1860 hbseozds.exe 1860 hbseozds.exe 1860 hbseozds.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2940 WINWORD.EXE 2940 WINWORD.EXE 2940 WINWORD.EXE 2940 WINWORD.EXE 2940 WINWORD.EXE 2940 WINWORD.EXE 2940 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4996 wrote to memory of 4360 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 89 PID 4996 wrote to memory of 4360 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 89 PID 4996 wrote to memory of 4360 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 89 PID 4996 wrote to memory of 2608 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 90 PID 4996 wrote to memory of 2608 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 90 PID 4996 wrote to memory of 2608 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 90 PID 4996 wrote to memory of 1208 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 91 PID 4996 wrote to memory of 1208 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 91 PID 4996 wrote to memory of 1208 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 91 PID 4996 wrote to memory of 3420 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 92 PID 4996 wrote to memory of 3420 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 92 PID 4996 wrote to memory of 3420 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 92 PID 4360 wrote to memory of 1860 4360 wjeqxeseih.exe 93 PID 4360 wrote to memory of 1860 4360 wjeqxeseih.exe 93 PID 4360 wrote to memory of 1860 4360 wjeqxeseih.exe 93 PID 4996 wrote to memory of 2940 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 94 PID 4996 wrote to memory of 2940 4996 73e013693da5ed75f739f5bfe74ed2d9.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\73e013693da5ed75f739f5bfe74ed2d9.exe"C:\Users\Admin\AppData\Local\Temp\73e013693da5ed75f739f5bfe74ed2d9.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\wjeqxeseih.exewjeqxeseih.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\SysWOW64\hbseozds.exeC:\Windows\system32\hbseozds.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1860
-
-
-
C:\Windows\SysWOW64\gkeyjctjxsposgp.exegkeyjctjxsposgp.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2608
-
-
C:\Windows\SysWOW64\hbseozds.exehbseozds.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1208
-
-
C:\Windows\SysWOW64\acsewkkdhydwf.exeacsewkkdhydwf.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3420
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5a442393e0cd433ed8e3c1fd55a30641b
SHA1e361d1e7dff4ee70f808da210eb265d6164af763
SHA256a395f6d6c8118410fa15e3cec7c51d0ce266ab5175fbd52717aca0b3e3ed66ed
SHA512e52c327a4f4b2d3342f2fcebe2950df8ae95a3bae265a27022b6282a8867930f3c48c3de7b0cbb0a28ed530e8abab0579f69b5c20b15e9e5671c4fc8ee354c20
-
Filesize
512KB
MD5040e882b7725732802c29a5fbec92e5c
SHA1c2eb9022bedf7102bcf70b699b133e6043414a43
SHA2565ca04eb65a42e19a5f7d6a3fd0afb2f55d948a5999b21e9745a7ce39739f4d5a
SHA5127dde1a539fbcb911ac04f52510f652bc402ef2cc5479ab1497269ccb696982625d452472ae88bb03c21cb0489103dbacbffd5e8c18ca64c842fe11bd109bf3e8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD525ff47fb3528a0d9fe7d2e1a0092c8f6
SHA10a4cd7b792dc684481fd7969b425bdd75590f5d6
SHA25664ac4dc709d870fb675b18f104c8b39753c81bdeabc0d343495ed0c16b0cfaab
SHA5123c92820c8b23289828c685f07776b52e180f4490e53c9dce7e267cebb5c465c711b9bb63c1aea158acdc76487e9a4dd3dc0aba8f84a016db642cdaccfe4358fb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5d62d2e3f7ebfda6cb054a619ebb7a94f
SHA1f538b3fae9f1a83d0f5362f5865f59af4e78be72
SHA2566cafbc37b4af5929b464dca41487c8b0a2636a61b7746287ac79ac0f59323791
SHA512215fe2801155adacb5b3132f1768933b7476d50bacde31cdc6ae7bfb731057cb7ba475b80d0cd90fe936f2797704b200420cfcefb6c0a725eb5cd4fda9b8b58b
-
Filesize
512KB
MD53adb6597827e313d4a32435428ebc00a
SHA1e678f89d54c1ae18ce237adb80ead02e305cb0bc
SHA2562031f364709e22dec9d3a8baaeaaf1177f6b3c18240c3d588236cb1f63e1f839
SHA5128fa7e7c10dd7a947cd308eb6095aaa62a79166db6409fe343d9483368b18878737250aa48289a2327d3987a4dd76ee3fa89fa3d4ee56846faa708527b334cce9
-
Filesize
512KB
MD5f7fb321526e0c9286e7e3fc8d2e454af
SHA1d80bba8c39008b5ce24e1472e97b503f72670263
SHA256e58960b5a34cde023845cba02c4c43ad7a72c161ad7a2a67fb4b3d17d6244e45
SHA5127dd1fbb1bc2ff94b756e2a102ba7c23e1b92b12525a27db048b8f1420e84ef66c6efce021329eee8e725cb7ee28f5a76a22c04f49dadb7c28e756de3cf351aa8
-
Filesize
512KB
MD5f40348ec875d8b715e4dcfd47dc82e68
SHA11427b559497856272f7a148b3339c8cd18bf3a44
SHA25621315145826606ccd96038a9e2ca9fd1ecdb4aa757b4104486278d247977ba52
SHA5127879bacb7bfdabe098892edf02db3c955afa01ea632465accaa93f35d0c8c07c15ac1bb764be3005756cff23ada989e13ece199f6bde3fd6b39ffb3d564a8b6d
-
Filesize
512KB
MD5ab077189298c07cf81b821754334b78e
SHA1be47e4b567da26366f955e0de2f11249fc9fd345
SHA256197abadeeeb89dddd84014638297cbb2ac20cc58c3cd863acf98133f77810fda
SHA512cb07fe63fbe6a813da4175663e57ac9fb63143edd6aa71ceef70882c491b87574d14c36f8f0ba51dc3d265bde6235407b14afeccb937db9db60c871f7ad4563c
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5622384f12e5420f8e33375498c1f912d
SHA1687c240c54a23a922bb5ab121cd67f1a47a96e15
SHA256310eb995b7291fe07cacdd4533be53de3ab7e5627a3e78c7e2c1ffb572e6c4e8
SHA51220f4bcdfadab2296a5c1e4bac01c272ef86e5b614bdd5550ed3dc14a0d95d0fd2f88ab70d9c7b7ce23e0304e2810a933c859c0a4cd18d72fe529e832b08a2f17
-
Filesize
512KB
MD579648dd858d2bd9351c54a78c0ece15b
SHA1cae835c8416c11ae9086d008d3993df8d25748a3
SHA256b8930c40c02cc876190afbcce2d1eb8636433adc9278529b7a88c6c8bc0bf380
SHA51295fc9690f5e9a63446da110603167955124a604751e0cc3e73b0d7dd8e32a803289b7f43035e27f31f8e9d3c40ddc4808341a8e24185007e34337c5afa14e1b1