Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
29/01/2024, 00:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
7e645940ea4408b7251f4812f61d142c.exe
Resource
win7-20231215-en
windows7-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
7e645940ea4408b7251f4812f61d142c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 7e645940ea4408b7251f4812f61d142c.exe
- Size 512KB
- Sample240129-aqevpsdhh8
- SHA256 326f835506dffda1ec03c6ce3356cb38ae476b73063683a1272834b798a1928e
- MD5 7e645940ea4408b7251f4812f61d142c
- SHA1 207b62de3ae4dafd4c20723d3cfbff6c139066bf
- SHA512 1495592dc98b16a80d42662215d17820dac011a7f64be314a1b28d9e17f66417605f4211a9527a122f3d10e431a2d15c1d072ceea9db8b128d2fefd8159789f3
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6h:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5y
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" sziupojdpt.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sziupojdpt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sziupojdpt.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sziupojdpt.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 7e645940ea4408b7251f4812f61d142c.exe - Executes dropped EXE 5 IoCs
pid Process 396 sziupojdpt.exe 1964 nwxnoaxxsalfcfz.exe 3820 dpyusnxd.exe 3644 xfwlmwsitaiiy.exe 3992 dpyusnxd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sziupojdpt.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jmokobdj = "sziupojdpt.exe" nwxnoaxxsalfcfz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rkklynys = "nwxnoaxxsalfcfz.exe" nwxnoaxxsalfcfz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xfwlmwsitaiiy.exe" nwxnoaxxsalfcfz.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: dpyusnxd.exe File opened (read-only) \??\o: dpyusnxd.exe File opened (read-only) \??\t: sziupojdpt.exe File opened (read-only) \??\q: dpyusnxd.exe File opened (read-only) \??\q: sziupojdpt.exe File opened (read-only) \??\h: dpyusnxd.exe File opened (read-only) \??\a: sziupojdpt.exe File opened (read-only) \??\o: sziupojdpt.exe File opened (read-only) \??\p: sziupojdpt.exe File opened (read-only) \??\b: dpyusnxd.exe File opened (read-only) \??\i: sziupojdpt.exe File opened (read-only) \??\j: dpyusnxd.exe File opened (read-only) \??\s: dpyusnxd.exe File opened (read-only) \??\v: dpyusnxd.exe File opened (read-only) \??\b: sziupojdpt.exe File opened (read-only) \??\e: sziupojdpt.exe File opened (read-only) \??\n: dpyusnxd.exe File opened (read-only) \??\u: dpyusnxd.exe File opened (read-only) \??\z: sziupojdpt.exe File opened (read-only) \??\r: dpyusnxd.exe File opened (read-only) \??\i: dpyusnxd.exe File opened (read-only) \??\q: dpyusnxd.exe File opened (read-only) \??\y: dpyusnxd.exe File opened (read-only) \??\v: sziupojdpt.exe File opened (read-only) \??\g: dpyusnxd.exe File opened (read-only) \??\w: dpyusnxd.exe File opened (read-only) \??\r: sziupojdpt.exe File opened (read-only) \??\s: sziupojdpt.exe File opened (read-only) \??\u: sziupojdpt.exe File opened (read-only) \??\b: dpyusnxd.exe File opened (read-only) \??\j: dpyusnxd.exe File opened (read-only) \??\k: dpyusnxd.exe File opened (read-only) \??\u: dpyusnxd.exe File opened (read-only) \??\k: sziupojdpt.exe File opened (read-only) \??\p: dpyusnxd.exe File opened (read-only) \??\a: dpyusnxd.exe File opened (read-only) \??\t: dpyusnxd.exe File opened (read-only) \??\n: sziupojdpt.exe File opened (read-only) \??\o: dpyusnxd.exe File opened (read-only) \??\m: dpyusnxd.exe File opened (read-only) \??\k: dpyusnxd.exe File opened (read-only) \??\z: dpyusnxd.exe File opened (read-only) \??\m: sziupojdpt.exe File opened (read-only) \??\h: sziupojdpt.exe File opened (read-only) \??\g: sziupojdpt.exe File opened (read-only) \??\l: sziupojdpt.exe File opened (read-only) \??\x: sziupojdpt.exe File opened (read-only) \??\l: dpyusnxd.exe File opened (read-only) \??\r: dpyusnxd.exe File opened (read-only) \??\v: dpyusnxd.exe File opened (read-only) \??\x: dpyusnxd.exe File opened (read-only) \??\t: dpyusnxd.exe File opened (read-only) \??\s: dpyusnxd.exe File opened (read-only) \??\j: sziupojdpt.exe File opened (read-only) \??\g: dpyusnxd.exe File opened (read-only) \??\m: dpyusnxd.exe File opened (read-only) \??\e: dpyusnxd.exe File opened (read-only) \??\w: sziupojdpt.exe File opened (read-only) \??\h: dpyusnxd.exe File opened (read-only) \??\i: dpyusnxd.exe File opened (read-only) \??\e: dpyusnxd.exe File opened (read-only) \??\l: dpyusnxd.exe File opened (read-only) \??\w: dpyusnxd.exe File opened (read-only) \??\x: dpyusnxd.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" sziupojdpt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" sziupojdpt.exe - AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2680-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000600000002321b-5.dat autoit_exe behavioral2/files/0x000600000002321a-19.dat autoit_exe behavioral2/files/0x000600000002321b-23.dat autoit_exe behavioral2/files/0x000600000002321b-22.dat autoit_exe behavioral2/files/0x000600000002321c-27.dat autoit_exe behavioral2/files/0x000600000002321c-26.dat autoit_exe behavioral2/files/0x000600000002321d-32.dat autoit_exe behavioral2/files/0x000600000002321d-31.dat autoit_exe behavioral2/files/0x000600000002321a-18.dat autoit_exe behavioral2/files/0x000600000002321c-35.dat autoit_exe behavioral2/files/0x000400000001da65-83.dat autoit_exe behavioral2/files/0x000200000001e72a-107.dat autoit_exe behavioral2/files/0x000700000002047e-120.dat autoit_exe behavioral2/files/0x000700000002047e-123.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\nwxnoaxxsalfcfz.exe 7e645940ea4408b7251f4812f61d142c.exe File opened for modification C:\Windows\SysWOW64\dpyusnxd.exe 7e645940ea4408b7251f4812f61d142c.exe File created C:\Windows\SysWOW64\xfwlmwsitaiiy.exe 7e645940ea4408b7251f4812f61d142c.exe File opened for modification C:\Windows\SysWOW64\xfwlmwsitaiiy.exe 7e645940ea4408b7251f4812f61d142c.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dpyusnxd.exe File created C:\Windows\SysWOW64\sziupojdpt.exe 7e645940ea4408b7251f4812f61d142c.exe File created C:\Windows\SysWOW64\nwxnoaxxsalfcfz.exe 7e645940ea4408b7251f4812f61d142c.exe File created C:\Windows\SysWOW64\dpyusnxd.exe 7e645940ea4408b7251f4812f61d142c.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll sziupojdpt.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification C:\Windows\SysWOW64\sziupojdpt.exe 7e645940ea4408b7251f4812f61d142c.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dpyusnxd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dpyusnxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dpyusnxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal dpyusnxd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dpyusnxd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dpyusnxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal dpyusnxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dpyusnxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal dpyusnxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal dpyusnxd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe dpyusnxd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dpyusnxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dpyusnxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe dpyusnxd.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dpyusnxd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dpyusnxd.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dpyusnxd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe dpyusnxd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dpyusnxd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dpyusnxd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe dpyusnxd.exe File opened for modification C:\Windows\mydoc.rtf 7e645940ea4408b7251f4812f61d142c.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe dpyusnxd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe dpyusnxd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 7e645940ea4408b7251f4812f61d142c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7806BB8FE6B21AAD27FD0D38A7D9160" 7e645940ea4408b7251f4812f61d142c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" sziupojdpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" sziupojdpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" sziupojdpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32402D0D9C2082236D4576A670552CDA7C8E65DD" 7e645940ea4408b7251f4812f61d142c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat sziupojdpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh sziupojdpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf sziupojdpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg sziupojdpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB0B02A44E7389852CDBADC339DD7BB" 7e645940ea4408b7251f4812f61d142c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1939C67A1596DAB7B9CD7C93EC9737CA" 7e645940ea4408b7251f4812f61d142c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" sziupojdpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc sziupojdpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" sziupojdpt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs sziupojdpt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABBF9CAFE65F197837F3B4081EC3E99B38C028A4364033FE1CD42E609A0" 7e645940ea4408b7251f4812f61d142c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF9FFF84F27851D9135D6207E96BDE4E6365946674E6337D69D" 7e645940ea4408b7251f4812f61d142c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" sziupojdpt.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings 7e645940ea4408b7251f4812f61d142c.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2376 WINWORD.EXE 2376 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 396 sziupojdpt.exe 1964 nwxnoaxxsalfcfz.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3992 dpyusnxd.exe 3992 dpyusnxd.exe 3992 dpyusnxd.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 2680 7e645940ea4408b7251f4812f61d142c.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 396 sziupojdpt.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 1964 nwxnoaxxsalfcfz.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3820 dpyusnxd.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3644 xfwlmwsitaiiy.exe 3992 dpyusnxd.exe 3992 dpyusnxd.exe 3992 dpyusnxd.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2376 WINWORD.EXE 2376 WINWORD.EXE 2376 WINWORD.EXE 2376 WINWORD.EXE 2376 WINWORD.EXE 2376 WINWORD.EXE 2376 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2680 wrote to memory of 396 2680 7e645940ea4408b7251f4812f61d142c.exe 84 PID 2680 wrote to memory of 396 2680 7e645940ea4408b7251f4812f61d142c.exe 84 PID 2680 wrote to memory of 396 2680 7e645940ea4408b7251f4812f61d142c.exe 84 PID 2680 wrote to memory of 1964 2680 7e645940ea4408b7251f4812f61d142c.exe 87 PID 2680 wrote to memory of 1964 2680 7e645940ea4408b7251f4812f61d142c.exe 87 PID 2680 wrote to memory of 1964 2680 7e645940ea4408b7251f4812f61d142c.exe 87 PID 2680 wrote to memory of 3820 2680 7e645940ea4408b7251f4812f61d142c.exe 85 PID 2680 wrote to memory of 3820 2680 7e645940ea4408b7251f4812f61d142c.exe 85 PID 2680 wrote to memory of 3820 2680 7e645940ea4408b7251f4812f61d142c.exe 85 PID 2680 wrote to memory of 3644 2680 7e645940ea4408b7251f4812f61d142c.exe 86 PID 2680 wrote to memory of 3644 2680 7e645940ea4408b7251f4812f61d142c.exe 86 PID 2680 wrote to memory of 3644 2680 7e645940ea4408b7251f4812f61d142c.exe 86 PID 2680 wrote to memory of 2376 2680 7e645940ea4408b7251f4812f61d142c.exe 88 PID 2680 wrote to memory of 2376 2680 7e645940ea4408b7251f4812f61d142c.exe 88 PID 396 wrote to memory of 3992 396 sziupojdpt.exe 90 PID 396 wrote to memory of 3992 396 sziupojdpt.exe 90 PID 396 wrote to memory of 3992 396 sziupojdpt.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e645940ea4408b7251f4812f61d142c.exe"C:\Users\Admin\AppData\Local\Temp\7e645940ea4408b7251f4812f61d142c.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\sziupojdpt.exesziupojdpt.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\dpyusnxd.exeC:\Windows\system32\dpyusnxd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3992
-
-
-
C:\Windows\SysWOW64\dpyusnxd.exedpyusnxd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3820
-
-
C:\Windows\SysWOW64\xfwlmwsitaiiy.exexfwlmwsitaiiy.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3644
-
-
C:\Windows\SysWOW64\nwxnoaxxsalfcfz.exenwxnoaxxsalfcfz.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1964
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2376
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 50059d407e27b1e91e78db4f57e27f7cc8c1d1626415ea0f4a63701165179e6a
- MD5 56b68e513277990b331a1b3eab8ed5af
- SHA1 25a0d2f0a55f6d8bf9b9a42199318557e080cd59
- SHA512 c1678ef7474e5906a86db067d8b4184adf50811ab4a8927b902d795011568dfae5ab47b5c522a1f6ce83f17e8866660a39efc69320aee56fcb393cecfc654354
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\ConvertFromStart.doc.exe
- Size 512KB
- SHA256 ecaec7f61af01347c8b913719b67787b3a95cfdc3244d8f9944c3508c83a9293
- MD5 bce685dcb3811dee2fad8a2f25f2697e
- SHA1 8199a7111dc6492366717e7884e69470025d9dbe
- SHA512 314f313efd0fa1e629d2a4e7871d5b18f3d328c58aeac62c74a4fec085af940881274a4a8781e27136a49a3129e8f23de6e30cd0126adaa7a819c7fe092f72a2
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6y:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 239B
- SHA256 3f95fb1d2ede3704b1b334bc177137ce8f0fc902e291e4f8e5eae25e22f455df
- MD5 8f47edabb9b9fee633e4a7520dcdaef3
- SHA1 7cc78a29b4503e905631e03ec39f9e406d233528
- SHA512 475066f63d3f91c625d6aeb4432621fe9101e540042dd733f1edf5ff197275942bca8c1221e84aa0ddddf827196d55d546de95c506caafcdff9a2e94f253af5a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 bd2c87167f378b901cd9076ed6a3687dad567b93de8b983088b0511a776c8ae0
- MD5 5ffa822fc947397d41d35f6aac02ed2f
- SHA1 8a73e624ed751405819c516dfbbc27d3863335cb
- SHA512 4cf8195a7b7a5c19851869c0e44818e8b5235e2e4f045d61b68ff83305555b64d097dc820f15f4d4001a283946ed3f02d82181f3271a49ac3f602d52cb331c3f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 215d0a27bbfec65263559e59d635ae06623bd1b7baaff0453c27750ec0540412
- MD5 0b7106e37dae2481246af3dd7c71bfb2
- SHA1 710e1959190e9d4f2f3c472dc1d466a852078ecb
- SHA512 7bb646efcc8a9607477f79c39fe25c004ede98749a9d9e39abba889b6a359f43629f86144553c282c675e4b554f926b8f4b7b1fde072bf333d687898038d9869
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\dpyusnxd.exe
- Size 105KB
- SHA256 0c4f10e5df7cf8bcc7e8d05254028f6d552abf979340eedaf5d654f1694253a2
- MD5 774b5990d743f3c1a9e19e375925c749
- SHA1 8d99ddeaa42d3104ae0db8531ca31a8d8e417fe8
- SHA512 892a29fcd74f4abb060247057cf0969f6cb1186d9a03be60e688bfee6475e06a553fbc768e0ed516184df45e356907b6a7793d25aa1b40aa7a325407afae6af0
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/B+:1VY0W0sVVZ/dkq5BCoFaJ+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\dpyusnxd.exe
- Size 155KB
- SHA256 d15dcb972e2dee386fe874ba646d95c48ecde3f8172a7fb87c3d3c0bc9fd4a85
- MD5 51f551eded311985e5366f8fd568fbcd
- SHA1 58af353eceb51a1d933348e8d757b3443f73bf13
- SHA512 2171e4ea20ed598421b37f6944aa4b5b10c6ba390f6eec1550f0f5c12251a7f177ad6346582224ee1d6de5f7cc4ea4ea1a397ec46d79eb660b146fd7a7fbdfd6
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/B2i5L4SzV/oIlAg1RC6TCWo:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24CR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\dpyusnxd.exe
- Size 512KB
- SHA256 97ddf4b5672fb8ca3011c0f672ffbc1965e322a47f7363b51fb01dd980ed2534
- MD5 00f17707b9836bee817a66e32870f132
- SHA1 d84526555d67bf8fae6c493a458c619412a5b9db
- SHA512 36166a874e3ebc12c32622717f134981ae038783c7045372fda51b01577fc2ab0a10cf05e225f35678ecce25cf7136f3c75b5590a67cb7b9630d9e97bb11c011
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\nwxnoaxxsalfcfz.exe
- Size 93KB
- SHA256 edaa465d9451a05905ef249bd4ed57ddf7c1d608289f0e2ecf64ed7b33bcf926
- MD5 038aa7c5fb92844bcc7b4c07c4751b2c
- SHA1 01ed3d91f73770901ba94eb2c5d3f05a967595b8
- SHA512 e1cb2690a095806684beb8cd7a5291fe661352ceb189e63469991909f598b52725980a43feba5281f08ad9044503bde8756ce34e354720bc848cde99f7afe1fe
- SSDEEP 1536:1VY0W0/xYGG2BIUuR1v7hvFPRVaai49TRIKl/75k3Jeu0Fyg4nJOWkkOBC3nh/4I:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC31X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\nwxnoaxxsalfcfz.exe
- Size 136KB
- SHA256 f464330f117d919e34e3ef7953325bc3ea0b53f25e3f82c88361682eddff3d87
- MD5 918941d0af9b62413058a8a327b44e18
- SHA1 4a019b463ed164d4a0355740889e35fdb3e2ad56
- SHA512 35e0841025ab4ee47713e372e8cf21a2e1ce3c6a6617ff2c25b4559e89569bf8561c985f173d576b3849b2b7d89ebfe1d06e620ae81e7b06cee63f52487caee5
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/B2i5L4SzV/oIlAg1J:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf2A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\nwxnoaxxsalfcfz.exe
- Size 406KB
- SHA256 e4800e58a4d4990fbce92304836c6b49d0ff417e766537395474b452fce9aa6d
- MD5 5d400c1bedadeb6ecf2ee069c2250ede
- SHA1 7966b20f215ef17cf2c75cefd3beaa3cd29293bf
- SHA512 5fbb394aca95d5bd08dbe7976d28ec4e7d7b98e75c8f8518d856db6badc4bc826368c9361062fd1edcd40bdad28611917405d71a4d93a43b5643d9067050782a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodjI:1gDhdkq5BCoC5LfWSLTUQpr2Zu19QmU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sziupojdpt.exe
- Size 183KB
- SHA256 59c2c462bbb3ca6e938bee7ebf6654bfde3f66978b4f7f52b7e68bdf1c6b015f
- MD5 d2f4ec68d42916b7781bae7d23eacafe
- SHA1 7736eb07d0a92531ebc082ad4ebc71514a090c27
- SHA512 ee32dbe66dcac023e4fda14876c085e1a8c9da2fa5b6593c6054067cd39d6853280f13bc20d1916963d4c1001a619760ef22607738c766339b066f5c1c004ebc
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/B2i5L4SzV/oIlAg1RC6TCWp:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C073
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sziupojdpt.exe
- Size 97KB
- SHA256 36083fefe2240f2219618cdea0060e46815e2546593a58d064c0e993921958c7
- MD5 d4a1bd9f54d284c339e28beb3c303e21
- SHA1 e474a15783b7f4eb1b0458a09b742deab19bf5a1
- SHA512 5aa36fa94b89569d5cb0993855bb1b1d8e3adee287f27f527a7f2cc033805dbef90c54316a1da49fa4e54ebdea5c44b377816ff6e7fa2831ea884aaf22cb1462
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0aV:1VY0W0sVVZ/dkq5BCoFaV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xfwlmwsitaiiy.exe
- Size 132KB
- SHA256 8a87a7e07bb37a4cb9324237880b2be1ab613c6ccb8c19261a5a4e5c326580bf
- MD5 bb028d5ca332aab2c4357df4836b869e
- SHA1 598c4d34277d01f379b2a18ac2949116939f3ee0
- SHA512 84177f52840d878907768b8fbe0a494d1846f6499f9a2488634000c16f23ff808e68d5c67c94a399d1f42e58d1406927ba7f6f6dcea89797813f8906af7703aa
- SSDEEP 3072:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC314BkqD5w0a/B2i5L4SzV/8:1VY0W0sVVZ/dkq5BCoFaJ2i5Lfi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\xfwlmwsitaiiy.exe
- Size 72KB
- SHA256 9fe2e050938661ab2e63f67024a7fd4ca15084cace7129568a883027d8bc00a2
- MD5 15c0c5a72964a7427dfc9027cf580382
- SHA1 b256a6e4f3db2b4cf6fc515534ad217a06c64fe8
- SHA512 8aae99aaed73518489892490993b558dc55a208aba3199190bd4c1a82c9658e16b5c50f5c8e7e687af15f6a9f677eff36c92d90e7eecbb9b1276056e527cc7f0
- SSDEEP 1536:1VY0W0/xYGG2BIUuR1v7hvFPRVaai49TRIKl/75k3Jeu0Fyg4nJOWkkOBC3d:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC3d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 471b123c3c9e7fb86e33382eebb49ae4b53ea65307d334f3e293d85a18aff884
- MD5 d6899ec1049f7e78babd9da9bdf1ea2b
- SHA1 5b1224929c9c95bef2a36e3a2b328ccc05642e04
- SHA512 12a01146b7ef97dbba5b25b87d6a1344eef53e2ec81c9c67825bc3d3c9ed58322879106fe587cf651d73f23107ca2ac23a3e6578ce8a34d6b496228d90b1476b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 db232aa84c5b99333bee250500b5da65b0d8f4b89534cc28c3e46e0f838dbd1f
- MD5 14da25e6ec07cbd23e3480026fd41085
- SHA1 b4a7b66a24fe10cccad928c240f8dc7ff296f509
- SHA512 789cd058d318913dab042e184d70001dc4f496302725c979daa933d9ed6ddf6eeb7d8b439d6cc3a0152075618f8c0c263fec8aebff7271829831281f54de7698
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- MD5 SHA1 SHA512 SSDEEP