Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 20:38
Static task
static1
Behavioral task
behavioral1
Sample
c6cea8c5fc22b62adf8d3cad5cbcff34.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
c6cea8c5fc22b62adf8d3cad5cbcff34.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
c6cea8c5fc22b62adf8d3cad5cbcff34.exe
-
Size
512KB
-
MD5
c6cea8c5fc22b62adf8d3cad5cbcff34
-
SHA1
64ca2d17f6d75ff821cf87dbfd1a118e10c2df70
-
SHA256
f3f6751c377ee0ec3a76f282a08ac553dcdd8c7d1f95894a5ce5d6a4d6e4ca63
-
SHA512
6cef436c832177d918032d4843165f1ff76be3502f854ac789f2a8a3dea5ae0cb020f73c1f9e723c41a7b6c0643a843f809e5f9eeb3976b84d956a5c64c417a6
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" bipsgegipo.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bipsgegipo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" bipsgegipo.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bipsgegipo.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation c6cea8c5fc22b62adf8d3cad5cbcff34.exe -
Executes dropped EXE 5 IoCs
pid Process 4380 bipsgegipo.exe 3492 anaafipkknttodc.exe 4356 cjtgnxlj.exe 1988 psfvshojxokop.exe 4532 cjtgnxlj.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bipsgegipo.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nlejblce = "anaafipkknttodc.exe" anaafipkknttodc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "psfvshojxokop.exe" anaafipkknttodc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ildtjjxh = "bipsgegipo.exe" anaafipkknttodc.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: cjtgnxlj.exe File opened (read-only) \??\t: cjtgnxlj.exe File opened (read-only) \??\y: cjtgnxlj.exe File opened (read-only) \??\s: bipsgegipo.exe File opened (read-only) \??\g: cjtgnxlj.exe File opened (read-only) \??\m: cjtgnxlj.exe File opened (read-only) \??\z: cjtgnxlj.exe File opened (read-only) \??\m: bipsgegipo.exe File opened (read-only) \??\q: cjtgnxlj.exe File opened (read-only) \??\r: cjtgnxlj.exe File opened (read-only) \??\w: cjtgnxlj.exe File opened (read-only) \??\j: bipsgegipo.exe File opened (read-only) \??\t: bipsgegipo.exe File opened (read-only) \??\l: cjtgnxlj.exe File opened (read-only) \??\m: cjtgnxlj.exe File opened (read-only) \??\o: bipsgegipo.exe File opened (read-only) \??\n: cjtgnxlj.exe File opened (read-only) \??\u: cjtgnxlj.exe File opened (read-only) \??\v: cjtgnxlj.exe File opened (read-only) \??\l: cjtgnxlj.exe File opened (read-only) \??\e: bipsgegipo.exe File opened (read-only) \??\b: cjtgnxlj.exe File opened (read-only) \??\g: cjtgnxlj.exe File opened (read-only) \??\s: cjtgnxlj.exe File opened (read-only) \??\t: cjtgnxlj.exe File opened (read-only) \??\o: cjtgnxlj.exe File opened (read-only) \??\i: cjtgnxlj.exe File opened (read-only) \??\i: cjtgnxlj.exe File opened (read-only) \??\l: bipsgegipo.exe File opened (read-only) \??\y: bipsgegipo.exe File opened (read-only) \??\y: cjtgnxlj.exe File opened (read-only) \??\a: bipsgegipo.exe File opened (read-only) \??\q: bipsgegipo.exe File opened (read-only) \??\h: cjtgnxlj.exe File opened (read-only) \??\p: cjtgnxlj.exe File opened (read-only) \??\b: cjtgnxlj.exe File opened (read-only) \??\v: cjtgnxlj.exe File opened (read-only) \??\i: bipsgegipo.exe File opened (read-only) \??\u: bipsgegipo.exe File opened (read-only) \??\w: bipsgegipo.exe File opened (read-only) \??\j: cjtgnxlj.exe File opened (read-only) \??\k: cjtgnxlj.exe File opened (read-only) \??\n: cjtgnxlj.exe File opened (read-only) \??\n: bipsgegipo.exe File opened (read-only) \??\w: cjtgnxlj.exe File opened (read-only) \??\q: cjtgnxlj.exe File opened (read-only) \??\p: bipsgegipo.exe File opened (read-only) \??\a: cjtgnxlj.exe File opened (read-only) \??\x: cjtgnxlj.exe File opened (read-only) \??\z: cjtgnxlj.exe File opened (read-only) \??\k: cjtgnxlj.exe File opened (read-only) \??\h: bipsgegipo.exe File opened (read-only) \??\k: bipsgegipo.exe File opened (read-only) \??\e: cjtgnxlj.exe File opened (read-only) \??\o: cjtgnxlj.exe File opened (read-only) \??\a: cjtgnxlj.exe File opened (read-only) \??\p: cjtgnxlj.exe File opened (read-only) \??\u: cjtgnxlj.exe File opened (read-only) \??\v: bipsgegipo.exe File opened (read-only) \??\x: bipsgegipo.exe File opened (read-only) \??\e: cjtgnxlj.exe File opened (read-only) \??\r: cjtgnxlj.exe File opened (read-only) \??\b: bipsgegipo.exe File opened (read-only) \??\g: bipsgegipo.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" bipsgegipo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" bipsgegipo.exe -
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1720-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000800000002320d-5.dat autoit_exe behavioral2/files/0x000900000002320a-18.dat autoit_exe behavioral2/files/0x000800000002320d-24.dat autoit_exe behavioral2/files/0x000800000002320d-23.dat autoit_exe behavioral2/files/0x0007000000023212-32.dat autoit_exe behavioral2/files/0x0007000000023212-31.dat autoit_exe behavioral2/files/0x0007000000023211-29.dat autoit_exe behavioral2/files/0x0007000000023211-28.dat autoit_exe behavioral2/files/0x000900000002320a-20.dat autoit_exe behavioral2/files/0x0007000000023211-48.dat autoit_exe behavioral2/files/0x000700000002321f-78.dat autoit_exe behavioral2/files/0x000700000002321e-72.dat autoit_exe behavioral2/files/0x001100000000074b-98.dat autoit_exe behavioral2/files/0x0009000000023203-119.dat autoit_exe behavioral2/files/0x0009000000023203-124.dat autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\bipsgegipo.exe c6cea8c5fc22b62adf8d3cad5cbcff34.exe File created C:\Windows\SysWOW64\psfvshojxokop.exe c6cea8c5fc22b62adf8d3cad5cbcff34.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll bipsgegipo.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification C:\Windows\SysWOW64\bipsgegipo.exe c6cea8c5fc22b62adf8d3cad5cbcff34.exe File created C:\Windows\SysWOW64\anaafipkknttodc.exe c6cea8c5fc22b62adf8d3cad5cbcff34.exe File opened for modification C:\Windows\SysWOW64\anaafipkknttodc.exe c6cea8c5fc22b62adf8d3cad5cbcff34.exe File created C:\Windows\SysWOW64\cjtgnxlj.exe c6cea8c5fc22b62adf8d3cad5cbcff34.exe File opened for modification C:\Windows\SysWOW64\cjtgnxlj.exe c6cea8c5fc22b62adf8d3cad5cbcff34.exe File opened for modification C:\Windows\SysWOW64\psfvshojxokop.exe c6cea8c5fc22b62adf8d3cad5cbcff34.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjtgnxlj.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjtgnxlj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjtgnxlj.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjtgnxlj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjtgnxlj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjtgnxlj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cjtgnxlj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjtgnxlj.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjtgnxlj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cjtgnxlj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjtgnxlj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cjtgnxlj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjtgnxlj.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjtgnxlj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjtgnxlj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cjtgnxlj.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification C:\Windows\mydoc.rtf c6cea8c5fc22b62adf8d3cad5cbcff34.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cjtgnxlj.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cjtgnxlj.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe cjtgnxlj.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cjtgnxlj.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cjtgnxlj.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe cjtgnxlj.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe cjtgnxlj.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cjtgnxlj.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe cjtgnxlj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB4FABAF917F198830F3B31819B39E1B0FB02FA4213023DE1B8429D08A9" c6cea8c5fc22b62adf8d3cad5cbcff34.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8EFCFF482682689042D72F7DE1BDE7E643593167356331D6EB" c6cea8c5fc22b62adf8d3cad5cbcff34.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184EC67D15E7DAB1B8BD7CE8EDE434CC" c6cea8c5fc22b62adf8d3cad5cbcff34.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc bipsgegipo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg bipsgegipo.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes c6cea8c5fc22b62adf8d3cad5cbcff34.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" bipsgegipo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" bipsgegipo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" bipsgegipo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" bipsgegipo.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings c6cea8c5fc22b62adf8d3cad5cbcff34.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf bipsgegipo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" bipsgegipo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33412C089D5082256A4476D570212CD77C8E64D6" c6cea8c5fc22b62adf8d3cad5cbcff34.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7816BB9FE1B22DCD27AD0A48B0E9162" c6cea8c5fc22b62adf8d3cad5cbcff34.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat bipsgegipo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh bipsgegipo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs bipsgegipo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" bipsgegipo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B1204495399E53BFB9A13299D7CC" c6cea8c5fc22b62adf8d3cad5cbcff34.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 688 WINWORD.EXE 688 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1988 psfvshojxokop.exe 3492 anaafipkknttodc.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 3492 anaafipkknttodc.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 3492 anaafipkknttodc.exe 3492 anaafipkknttodc.exe 3492 anaafipkknttodc.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 3492 anaafipkknttodc.exe 3492 anaafipkknttodc.exe 4356 cjtgnxlj.exe 4356 cjtgnxlj.exe 4356 cjtgnxlj.exe 4356 cjtgnxlj.exe 4356 cjtgnxlj.exe 4356 cjtgnxlj.exe 4356 cjtgnxlj.exe 4356 cjtgnxlj.exe 4380 bipsgegipo.exe 4380 bipsgegipo.exe 4380 bipsgegipo.exe 4380 bipsgegipo.exe 4380 bipsgegipo.exe 4380 bipsgegipo.exe 4380 bipsgegipo.exe 4380 bipsgegipo.exe 4380 bipsgegipo.exe 4380 bipsgegipo.exe 3492 anaafipkknttodc.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 1988 psfvshojxokop.exe 3492 anaafipkknttodc.exe 3492 anaafipkknttodc.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 4356 cjtgnxlj.exe 4380 bipsgegipo.exe 4356 cjtgnxlj.exe 4380 bipsgegipo.exe 4356 cjtgnxlj.exe 4380 bipsgegipo.exe 4532 cjtgnxlj.exe 4532 cjtgnxlj.exe 4532 cjtgnxlj.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 3492 anaafipkknttodc.exe 1988 psfvshojxokop.exe 4356 cjtgnxlj.exe 4380 bipsgegipo.exe 4356 cjtgnxlj.exe 4380 bipsgegipo.exe 4356 cjtgnxlj.exe 4380 bipsgegipo.exe 4532 cjtgnxlj.exe 4532 cjtgnxlj.exe 4532 cjtgnxlj.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 688 WINWORD.EXE 688 WINWORD.EXE 688 WINWORD.EXE 688 WINWORD.EXE 688 WINWORD.EXE 688 WINWORD.EXE 688 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1720 wrote to memory of 4380 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 88 PID 1720 wrote to memory of 4380 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 88 PID 1720 wrote to memory of 4380 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 88 PID 1720 wrote to memory of 3492 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 89 PID 1720 wrote to memory of 3492 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 89 PID 1720 wrote to memory of 3492 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 89 PID 1720 wrote to memory of 4356 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 90 PID 1720 wrote to memory of 4356 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 90 PID 1720 wrote to memory of 4356 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 90 PID 1720 wrote to memory of 1988 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 91 PID 1720 wrote to memory of 1988 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 91 PID 1720 wrote to memory of 1988 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 91 PID 1720 wrote to memory of 688 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 94 PID 1720 wrote to memory of 688 1720 c6cea8c5fc22b62adf8d3cad5cbcff34.exe 94 PID 4380 wrote to memory of 4532 4380 bipsgegipo.exe 96 PID 4380 wrote to memory of 4532 4380 bipsgegipo.exe 96 PID 4380 wrote to memory of 4532 4380 bipsgegipo.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6cea8c5fc22b62adf8d3cad5cbcff34.exe"C:\Users\Admin\AppData\Local\Temp\c6cea8c5fc22b62adf8d3cad5cbcff34.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\bipsgegipo.exebipsgegipo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\cjtgnxlj.exeC:\Windows\system32\cjtgnxlj.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4532
-
-
-
C:\Windows\SysWOW64\anaafipkknttodc.exeanaafipkknttodc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3492
-
-
C:\Windows\SysWOW64\cjtgnxlj.execjtgnxlj.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4356
-
-
C:\Windows\SysWOW64\psfvshojxokop.exepsfvshojxokop.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1988
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:688
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5416bbf42053200a30e8228dc8e912454
SHA19837505c0726e72d771809f255e4910af7e39380
SHA256e1b73f7a92cd39b78c0cff43b12c99a9aa124869095c51597e2cc2b113244c4f
SHA512e426f8bc9c951d219fbce4c97f7c9a822b4ace10f8ec396af68f63c7fa38e221a3a7169f4b449ced3f4cf29d0a16449fb89de1f7f335e594407147108cd44460
-
Filesize
512KB
MD52628af671e5e1c3dde7d58c211501221
SHA18aa5f18c1bc3905eafdb24864272f406c3b8988e
SHA256f55f74c50ed37fc42e1bf2990698f98ce6f11e076404acd7395381bdfe18435f
SHA51258483e9c3119f2416e51d9ef2d3a980d230afaf65b0349786caf132b723def7b7c30c712da0810953f9d7603bfb519487453cc078360b1f8ef0787e0bcef7100
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD50d1bfaaf417754e74e36798ac4d4f8dd
SHA1a015eb791a95d0540482a315302b67dc67c07884
SHA256f0d9a3d3f98c0b9f7b292058b2d4c046988ef69923a39c4f2626cd3c2f9946cb
SHA512aac7c4eaf9549eb86b7fd3abdb2e7fbfd884b61a69662e2937cf8bc786aaefcfd60635029a5320e3aba6fb58a6da057077ce54038b0b7dedb215afa9674c310e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5b1be2d5bc6d575f1f9aa78c37aa62779
SHA135943f1b452c95088b79504f171455433c607f85
SHA256f0a9d9241ab7a736686b6db639c7eb0d7514437efaf02a9715b96a10d506fa6c
SHA5126f639a69e1b6ed5f981f0b0eb36e4d2b2a6376b1d8aa0f429931184f8c1eb42d93c1219d10664da2147066c9de27b9ca1db2cf8a2207020f68c68b42b39acd3b
-
Filesize
512KB
MD563a708dd7aef147018b0304e61e43fce
SHA12551508bf4a22a2f888ec48e0b2e6c8cd1c058f3
SHA25626464ce941d8d4676e96fc00f59233df014a7117260c0a0c4a35c9195cc8f1c4
SHA5123a53d6414be91618e22a9e05652cac8d2b0dc5927615bea8c408679b5de06d3626c8c79bffeb9db9aa5d4c88989f4dd13b8d7faa43445be5084d5eb16f1c4023
-
Filesize
190KB
MD5b62a610718edd8439a0d968c13e90bf3
SHA1787e38226796f109e86e9911c108026677ceaaa0
SHA25638dedd01b8e3880aeb878b2c58aecc301fb691b42dd8e4236092f16e205728ec
SHA5124a06f567884526a968f50d9f030859d783fa94242cbaa05a82fd378bc61acf3cc43aaf6b898b0584190a075a3545c08518835579272cd6cea69c73c4cffdafed
-
Filesize
246KB
MD5465365eafe185c2d7a7c3d4fbbd788c8
SHA13b36e5c5c14ef0579557abb42b95e98d1ef55564
SHA25679f05a4a2ffe3116e476cc366c210edc26b5fd0a994f6cb6c27d9456da2e0e53
SHA512a5c1f39b1b8d093837bdce47305affb24b85039dcdc0701d8143a3ea20e1fdf6bab3795603cb0e22ddb3f9f261693879b6956ccb1af967e7ba0c8a4340004d87
-
Filesize
512KB
MD51348a2126a79dd9b1d3945aa2812578a
SHA145715dc9c4f867cc0ec6a7ceab49df99e4a1634e
SHA256ba85d08bcee85b0a8621fbbf172fe8f580264cae44fa5188ac088c5be939c0a3
SHA512e55da2335a91215290d17761708cba4f9fb6b0bbce057cc05f0b99828a711c68a666322eb9a75a1707061f6453f033495ff605d81a0484fe4b02b70df04e111c
-
Filesize
249KB
MD53a1bb6d93383ebe9bc0480acbe4a2674
SHA1221e96bd3adc975c56d4e2112a70944cf5df8421
SHA256a79cdc5739bbc10a92a13d2cd9d6117d091d1a7a64b1324b8ad5d315d2566800
SHA512bc590e75b2045b8bc8a511ae860a8195b9fa1c7541849de5297b79fd614073659110264fa91c2b52bd67127b287755dbe4235478a7bf3a8530e1c9890979d1f9
-
Filesize
281KB
MD54a688c7331ba7a951ec5baf631316758
SHA199305a785a9435f620cb9362d488faf5a7e25466
SHA2567247b1240c0614857d1d034a1c4050fc07021dc678f8f3f79c7a94e52e7d9340
SHA5128cbd02a79e6e7d457572137f8a7af4208b13123850414e8d31bf7854aef045f081c45a6528579f64991a99d57255355cc908603aa2a099c86eaecbcb7d09674a
-
Filesize
169KB
MD59da4c79085feb181e3cb99b36b3dab92
SHA1e41c3edf95fb5dcbe8c83f10b71bb215e8881c72
SHA256f2eeb33ed2c9bfe08fdf091ef01bb107b39d33aff39b1ceebc1d0932de036912
SHA51272b8771398358fca9b7585630c8efb5d8d53e48eaa39323cb644d3160786cce882661cb6b6d5d04daa764afa61f6be85111fa5e337d63c5b205c565998535f88
-
Filesize
191KB
MD5816aa364fec76856c546bdec2670b75a
SHA19dfa3b8d1c1fcdb3c11b3fd9119c7a54a67293b4
SHA256252f9372ef612d850bb069c5bd03a3b7d60222431173362b56fa5bfa0ad3bd7a
SHA5124581ec4a48548acd7de1a45be96e67cb756f6cf0b05106ffc0cbfc614943bd8c588c1a5668612929050e8edefa4d845e8d9cacffb886091e498313dfd4a727b9
-
Filesize
512KB
MD5e1b87ee7810440f44c1f8bb0a8c1ab9d
SHA12d02c2fbb01ec4fd9ac0beebe1108e9492a38455
SHA2560c0d90e51919d2df6870ca611e86b0ce952d9df30c1b12e35cc7f52fbb74807f
SHA512d8fded04605f25cc58fecb1a47048b862801261107e9d42a8f6af3af46265eb9572931cf2bcb494a40e75c39435a5d43bb89389d8188a91483cb9646bc20d9ac
-
Filesize
132KB
MD505c3b357d4a733d774fa30649d24b9b2
SHA14a60bd4fbad78a8ee3d6127dec5a551b6dea942b
SHA25647ad2eb52f9e24ec48f1a43454de1d4422311d5e290bc8915746d167d0d8cd89
SHA5120b82fcc9b2e54a6c88fd221c03be3c4591e98bf194aae7634bd8cc2b1b47d834eea9265b29d2c92cb23c0eefbd5da5c98716a0bb10bae0c0278e6c4f3fc6cc24
-
Filesize
167KB
MD516daddf2ffd6667a82fcce36aeab72db
SHA10341c9c791ec39d5703b4e7b44a924a956457881
SHA256afb978072ed3c6760384e861428a388b9e4b7cc428af219186e25bd066a9a39d
SHA512637032ff9ed5e401d76342a40a222b7acc5c28dc8cb8be203656e656217393efdd2535bbd65d7b94a4082593827cfaa3b39c360ae43c40eb3d0729b32ca9f806
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD505405ad514e2263cfcd1ff25e1f75d2b
SHA1ce80cbab2f31c45e0a375a3190ee1bda2313b7f6
SHA256b4159e59d006dd78e3616efb18eec26bafef704ebd7ff77c6c1b8c90433faaf7
SHA512e34c00a406c38976e51c829ede4b9b4da7928195bad5a4f076b4f3acd0048a5c40133529b7eede7f8291d0dc0b668487e356961334d1615ef8255de7443db524
-
Filesize
512KB
MD55dc568d7514bf8302ce8ddf86955b743
SHA1ff2694db01054b0adf988705047cb2fa4d67803f
SHA25687b24174690ba07f8559d653f19d41d07be61af0dc4aaa5598bdfbc87c6f58ea
SHA51212aafc749bc4b4ff1761d79b89520e79ca4307ae2a12aaf8222992b8119b79cb9e77ba77d45929a29ffc09ed01e403f9b8c277effbb0e567dc08698bbd2845bc