Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
179s -
max time network
196s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 20:19
Static task
static1
Behavioral task
behavioral1
Sample
5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe
Resource
win10v2004-20240226-en
General
-
Target
5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe
-
Size
101KB
-
MD5
36b60168bec479ecaefae425f53de5e7
-
SHA1
db9f0eb6c2be6c9304279c9836010c69dd02e726
-
SHA256
5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1
-
SHA512
678be0cc3473c994e72663338ba00947c99846c01e489324d2f26493557b05778fc6a463fe1445fc58c13d262c8e70573e8d6a0b57dcc805f7ced1f9d951fb08
-
SSDEEP
3072:UBG6lEihCgkrQIixrse343/zrB3g3k8p4qI4/HQCC:UBkrVixDEPBZs/HNC
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 34 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Llpchaqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hchqbkkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kongmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kehojiej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lefkkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Mdnebc32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hcjmhk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kehojiej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lahbei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hnmeodjc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kongmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lhbkac32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Mdnebc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Dgdgijhp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kopcbo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdpiqehp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Llpchaqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Lamlphoo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Dgdgijhp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hnmeodjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kopcbo32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lamlphoo.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lefkkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Hgapmj32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hchqbkkm.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hcjmhk32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Kdmlkfjb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kdpiqehp.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Hgapmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}" Kdmlkfjb.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lahbei32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Lhbkac32.exe -
Executes dropped EXE 17 IoCs
pid Process 1576 Hgapmj32.exe 2524 Hchqbkkm.exe 3684 Hnmeodjc.exe 4256 Hcjmhk32.exe 2360 Kongmo32.exe 1656 Kehojiej.exe 3452 Kopcbo32.exe 1000 Kdmlkfjb.exe 3984 Kdpiqehp.exe 1268 Lahbei32.exe 1648 Lhbkac32.exe 4432 Lefkkg32.exe 4168 Llpchaqg.exe 3500 Lamlphoo.exe 380 Mdnebc32.exe 3340 Dgdgijhp.exe 3672 Dbkhnk32.exe -
Drops file in System32 directory 51 IoCs
description ioc Process File created C:\Windows\SysWOW64\Lahbei32.exe Kdpiqehp.exe File created C:\Windows\SysWOW64\Ejioqkck.dll Hnmeodjc.exe File created C:\Windows\SysWOW64\Mhfdfbqe.dll Hcjmhk32.exe File created C:\Windows\SysWOW64\Kdpiqehp.exe Kdmlkfjb.exe File created C:\Windows\SysWOW64\Kdmlkfjb.exe Kopcbo32.exe File created C:\Windows\SysWOW64\Lfeliqka.dll Kdpiqehp.exe File created C:\Windows\SysWOW64\Kdlmhj32.dll Lahbei32.exe File created C:\Windows\SysWOW64\Dgdgijhp.exe Mdnebc32.exe File created C:\Windows\SysWOW64\Naefjl32.dll Dgdgijhp.exe File created C:\Windows\SysWOW64\Hgapmj32.exe 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe File opened for modification C:\Windows\SysWOW64\Hcjmhk32.exe Hnmeodjc.exe File created C:\Windows\SysWOW64\Kopcbo32.exe Kehojiej.exe File created C:\Windows\SysWOW64\Olkpol32.dll Lhbkac32.exe File created C:\Windows\SysWOW64\Mdnebc32.exe Lamlphoo.exe File opened for modification C:\Windows\SysWOW64\Hnmeodjc.exe Hchqbkkm.exe File created C:\Windows\SysWOW64\Hcjmhk32.exe Hnmeodjc.exe File opened for modification C:\Windows\SysWOW64\Kopcbo32.exe Kehojiej.exe File opened for modification C:\Windows\SysWOW64\Kongmo32.exe Hcjmhk32.exe File created C:\Windows\SysWOW64\Mfmeel32.dll Kongmo32.exe File opened for modification C:\Windows\SysWOW64\Lahbei32.exe Kdpiqehp.exe File created C:\Windows\SysWOW64\Lamlphoo.exe Llpchaqg.exe File created C:\Windows\SysWOW64\Kongmo32.exe Hcjmhk32.exe File opened for modification C:\Windows\SysWOW64\Dgdgijhp.exe Mdnebc32.exe File opened for modification C:\Windows\SysWOW64\Kehojiej.exe Kongmo32.exe File created C:\Windows\SysWOW64\Epqblnhh.dll Kdmlkfjb.exe File created C:\Windows\SysWOW64\Pjijdf32.dll Llpchaqg.exe File opened for modification C:\Windows\SysWOW64\Lefkkg32.exe Lhbkac32.exe File created C:\Windows\SysWOW64\Llfgke32.dll Kehojiej.exe File created C:\Windows\SysWOW64\Fbkcnp32.dll Kopcbo32.exe File created C:\Windows\SysWOW64\Lefkkg32.exe Lhbkac32.exe File opened for modification C:\Windows\SysWOW64\Mdnebc32.exe Lamlphoo.exe File opened for modification C:\Windows\SysWOW64\Llpchaqg.exe Lefkkg32.exe File created C:\Windows\SysWOW64\Kchhih32.dll Lamlphoo.exe File opened for modification C:\Windows\SysWOW64\Dbkhnk32.exe Dgdgijhp.exe File created C:\Windows\SysWOW64\Mohpjh32.dll Hchqbkkm.exe File opened for modification C:\Windows\SysWOW64\Kdmlkfjb.exe Kopcbo32.exe File created C:\Windows\SysWOW64\Llpchaqg.exe Lefkkg32.exe File opened for modification C:\Windows\SysWOW64\Lhbkac32.exe Lahbei32.exe File opened for modification C:\Windows\SysWOW64\Hgapmj32.exe 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe File created C:\Windows\SysWOW64\Nijmbbnl.dll 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe File created C:\Windows\SysWOW64\Hnmeodjc.exe Hchqbkkm.exe File opened for modification C:\Windows\SysWOW64\Lamlphoo.exe Llpchaqg.exe File created C:\Windows\SysWOW64\Dbkhnk32.exe Dgdgijhp.exe File created C:\Windows\SysWOW64\Hchqbkkm.exe Hgapmj32.exe File created C:\Windows\SysWOW64\Dadeofnh.dll Hgapmj32.exe File created C:\Windows\SysWOW64\Abggif32.dll Lefkkg32.exe File opened for modification C:\Windows\SysWOW64\Hchqbkkm.exe Hgapmj32.exe File created C:\Windows\SysWOW64\Kehojiej.exe Kongmo32.exe File created C:\Windows\SysWOW64\Lhbkac32.exe Lahbei32.exe File opened for modification C:\Windows\SysWOW64\Kdpiqehp.exe Kdmlkfjb.exe File created C:\Windows\SysWOW64\Fgpoahbe.dll Mdnebc32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1684 3672 WerFault.exe 108 -
Modifies registry class 54 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nijmbbnl.dll" 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kopcbo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kdmlkfjb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lahbei32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epqblnhh.dll" Kdmlkfjb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lefkkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abggif32.dll" Lefkkg32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naefjl32.dll" Dgdgijhp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hchqbkkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbkcnp32.dll" Kopcbo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kdpiqehp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Llpchaqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lamlphoo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831} 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgpoahbe.dll" Mdnebc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hchqbkkm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kongmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kehojiej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olkpol32.dll" Lhbkac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Dgdgijhp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mohpjh32.dll" Hchqbkkm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hnmeodjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kongmo32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Kehojiej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfeliqka.dll" Kdpiqehp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lhbkac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjijdf32.dll" Llpchaqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lahbei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Mdnebc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hnmeodjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hcjmhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kdpiqehp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Hgapmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llfgke32.dll" Kehojiej.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lhbkac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Llpchaqg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kchhih32.dll" Lamlphoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Mdnebc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejioqkck.dll" Hnmeodjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hcjmhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kopcbo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Kdmlkfjb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Lamlphoo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dadeofnh.dll" Hgapmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhfdfbqe.dll" Hcjmhk32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment" Lefkkg32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Hgapmj32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfmeel32.dll" Kongmo32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdlmhj32.dll" Lahbei32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32 Dgdgijhp.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 836 wrote to memory of 1576 836 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe 92 PID 836 wrote to memory of 1576 836 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe 92 PID 836 wrote to memory of 1576 836 5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe 92 PID 1576 wrote to memory of 2524 1576 Hgapmj32.exe 93 PID 1576 wrote to memory of 2524 1576 Hgapmj32.exe 93 PID 1576 wrote to memory of 2524 1576 Hgapmj32.exe 93 PID 2524 wrote to memory of 3684 2524 Hchqbkkm.exe 94 PID 2524 wrote to memory of 3684 2524 Hchqbkkm.exe 94 PID 2524 wrote to memory of 3684 2524 Hchqbkkm.exe 94 PID 3684 wrote to memory of 4256 3684 Hnmeodjc.exe 95 PID 3684 wrote to memory of 4256 3684 Hnmeodjc.exe 95 PID 3684 wrote to memory of 4256 3684 Hnmeodjc.exe 95 PID 4256 wrote to memory of 2360 4256 Hcjmhk32.exe 96 PID 4256 wrote to memory of 2360 4256 Hcjmhk32.exe 96 PID 4256 wrote to memory of 2360 4256 Hcjmhk32.exe 96 PID 2360 wrote to memory of 1656 2360 Kongmo32.exe 97 PID 2360 wrote to memory of 1656 2360 Kongmo32.exe 97 PID 2360 wrote to memory of 1656 2360 Kongmo32.exe 97 PID 1656 wrote to memory of 3452 1656 Kehojiej.exe 98 PID 1656 wrote to memory of 3452 1656 Kehojiej.exe 98 PID 1656 wrote to memory of 3452 1656 Kehojiej.exe 98 PID 3452 wrote to memory of 1000 3452 Kopcbo32.exe 99 PID 3452 wrote to memory of 1000 3452 Kopcbo32.exe 99 PID 3452 wrote to memory of 1000 3452 Kopcbo32.exe 99 PID 1000 wrote to memory of 3984 1000 Kdmlkfjb.exe 100 PID 1000 wrote to memory of 3984 1000 Kdmlkfjb.exe 100 PID 1000 wrote to memory of 3984 1000 Kdmlkfjb.exe 100 PID 3984 wrote to memory of 1268 3984 Kdpiqehp.exe 101 PID 3984 wrote to memory of 1268 3984 Kdpiqehp.exe 101 PID 3984 wrote to memory of 1268 3984 Kdpiqehp.exe 101 PID 1268 wrote to memory of 1648 1268 Lahbei32.exe 102 PID 1268 wrote to memory of 1648 1268 Lahbei32.exe 102 PID 1268 wrote to memory of 1648 1268 Lahbei32.exe 102 PID 1648 wrote to memory of 4432 1648 Lhbkac32.exe 103 PID 1648 wrote to memory of 4432 1648 Lhbkac32.exe 103 PID 1648 wrote to memory of 4432 1648 Lhbkac32.exe 103 PID 4432 wrote to memory of 4168 4432 Lefkkg32.exe 104 PID 4432 wrote to memory of 4168 4432 Lefkkg32.exe 104 PID 4432 wrote to memory of 4168 4432 Lefkkg32.exe 104 PID 4168 wrote to memory of 3500 4168 Llpchaqg.exe 105 PID 4168 wrote to memory of 3500 4168 Llpchaqg.exe 105 PID 4168 wrote to memory of 3500 4168 Llpchaqg.exe 105 PID 3500 wrote to memory of 380 3500 Lamlphoo.exe 106 PID 3500 wrote to memory of 380 3500 Lamlphoo.exe 106 PID 3500 wrote to memory of 380 3500 Lamlphoo.exe 106 PID 380 wrote to memory of 3340 380 Mdnebc32.exe 107 PID 380 wrote to memory of 3340 380 Mdnebc32.exe 107 PID 380 wrote to memory of 3340 380 Mdnebc32.exe 107 PID 3340 wrote to memory of 3672 3340 Dgdgijhp.exe 108 PID 3340 wrote to memory of 3672 3340 Dgdgijhp.exe 108 PID 3340 wrote to memory of 3672 3340 Dgdgijhp.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe"C:\Users\Admin\AppData\Local\Temp\5f1a6c5b5ff48822f0feb1837db42dca6785f79142d29f37606c093c91c759d1.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\Hgapmj32.exeC:\Windows\system32\Hgapmj32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\Hchqbkkm.exeC:\Windows\system32\Hchqbkkm.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\Hnmeodjc.exeC:\Windows\system32\Hnmeodjc.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Windows\SysWOW64\Hcjmhk32.exeC:\Windows\system32\Hcjmhk32.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\Kongmo32.exeC:\Windows\system32\Kongmo32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\Kehojiej.exeC:\Windows\system32\Kehojiej.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\Kopcbo32.exeC:\Windows\system32\Kopcbo32.exe8⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\Kdmlkfjb.exeC:\Windows\system32\Kdmlkfjb.exe9⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\Kdpiqehp.exeC:\Windows\system32\Kdpiqehp.exe10⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\Lahbei32.exeC:\Windows\system32\Lahbei32.exe11⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\Lhbkac32.exeC:\Windows\system32\Lhbkac32.exe12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\Lefkkg32.exeC:\Windows\system32\Lefkkg32.exe13⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\Llpchaqg.exeC:\Windows\system32\Llpchaqg.exe14⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\Lamlphoo.exeC:\Windows\system32\Lamlphoo.exe15⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\Mdnebc32.exeC:\Windows\system32\Mdnebc32.exe16⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Windows\SysWOW64\Dgdgijhp.exeC:\Windows\system32\Dgdgijhp.exe17⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\Dbkhnk32.exeC:\Windows\system32\Dbkhnk32.exe18⤵
- Executes dropped EXE
PID:3672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 42019⤵
- Program crash
PID:1684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3672 -ip 36721⤵PID:4004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD58cc129b3678b6a1454e6ddb8b0f8eb77
SHA1bb666aa00c79804c85c5636e603b933bdc305d2c
SHA25641b3f7dfd0776206fc2114796069f8bbea0fddb560aca99012bb9e1bd3c91641
SHA51202248e7c22d7a2d5aec1c4285eae9f10fe3e56edb94e38f7e618fa23313a0984da714d7b52baad58e0b470cd5e8602f7bbe12bb6cfbbd355688544c7557ba9c5
-
Filesize
101KB
MD57f49c2ad6212d4d0a6069a64505fba65
SHA111a1cdbdf2228193789c3689590beda6fb3afbb7
SHA25690c77758aad146daf1f6b5a4ff8521267e4b93cd48a0b13a90a7d06acea4323b
SHA5124a6309ecc32e3d9f0eec021ee1ed70da764b663cbcd0512b0e526ba42cac1c47a64ecd8bd20ac2983fa4dddd8fd714b4c9c016727143ce670491829b331fe654
-
Filesize
101KB
MD5735ab2205aa2769326c6c8d584cf1464
SHA1b7f50f404649c0d2a42904401ad16bd8ad1b16ac
SHA25622379d3821bc667a4305312ed466ec39d2d5cc0c56920839feaf00dfae2624b9
SHA51234b88348e74f07ad4a6f80ed4169e49e6a9676d705084fad68657b230597718f1561f95a842fea68bab7e2806700d9f30e6d9b731b94a6738500667eb15c0197
-
Filesize
101KB
MD5f431406efda4c68b403ad15c0d1253a2
SHA1b1a34e17880f3e122f8e7ec7b805062e8a7bde0d
SHA2567ff79c534a21ee23c7086aa350573253d3a39b764c632936906639720cb0c1a5
SHA512686e26eb261a3762f3cd0164f71227906bb6e54cc78da2e5c6c80fa4f787248aa4b6257ed9d4116c78bba9e32fd1b45b9b678cefb4b95ad445d0519ebeb0b7d4
-
Filesize
101KB
MD5609291fdfb18416c6e436e10e556cefc
SHA1167dbb1004f7237bd42841f2e3f6d04dea91e09d
SHA25685648ae46a044661c2b12a47ccced02434f976e40fea3c590198c557f594fea3
SHA51221842998a1b7025827d5bdb8274c2436e9fad70db65421210db72ea22c09f072550bd5bf3aca2d3b7b2ab986d7e737b9736cf00079619413038b0667bd97b703
-
Filesize
101KB
MD5e8e673218609bd3e1effa80edb59c694
SHA1a67ef93bd04d6e4cdcd4cd3f60477784c99d0432
SHA256a60503b9254b4aaf5f8f532f2fa5cf05af656dfb976bbb81fb09f01e75d2c541
SHA512bb7f72441345f731a20aa0ca488783022b5f354a8f9712c3054b1d10e157f45cad52fd8b961f259f666b458351be9fee71c57520ccac2a6afe5c0b238108b1e8
-
Filesize
101KB
MD5aaa6d7eef946e01542090276021033d7
SHA1d38e1268a3c511d9caae0e33d361d0276fd6d850
SHA256678ee53aaf0cdb05ef71a877db85fd539e26628b52c75228365d0de3e29bf9ec
SHA512e7b0d650c8b66becdf0cd2399226c31e6445c1b8b4e4aa5d5bb3b5aad0f388890136bf55fdfcce4b8e48b75a318aa5e3ddde067bd34d05e670e357cd603b7d94
-
Filesize
101KB
MD5f0fa639f1b98c0a56d5f48be222aa3fc
SHA15f088c7a482c16d4a9b9c6c77768753e580ee115
SHA256d11d10a73909778cc4edf3de91b24cea91b7b862b34046585af4e842b5dcd41e
SHA512b8eef75b3d487bfb0a274ce005ce24d05760458ff19eb5ea7a955480615b3303a4710727dabdae21ecbcf438db8d74e6fa605a2fbbfc18ec4811f8f3dc4287b2
-
Filesize
101KB
MD5a399201db350cb6533d74fd2e373803d
SHA1a37482fc40d5ec28b6b2e878bddf07add104a288
SHA2564a16fd9ff02aae5f88cd1f7511f19b79f370d9542d5025baa8485526686e1895
SHA512011b6d9de859d31ccbd16a5802feb649853c37e2679f222e7b2bbbcb8511bd0fdd92bbd7128cc6c0249eaf38369663b9b23056465ddf6a60d5a53f27da0b2635
-
Filesize
101KB
MD5b2772f5833a9fe0c337a0897c3d68606
SHA1c0aa4e4b4dc766efdf438213f85e1d9eebdda1a2
SHA2567d55b2a3c69e0dfd1fd8de492f44075357f47473cef7eeccbf3d3dbd3ea85f71
SHA5125b54d9e605f4c25558d583e154e29a1d0124c7102c90dc7d5e3bc9e209661c9055bbdf8d8e8cb97136b2c3155ae32f91992cf8f9fbe4cf488fbbe0f8be331278
-
Filesize
101KB
MD582590bff0bb67f4bda2a9f8b18c640dd
SHA14def99d9756bbdacd9fcf557d7fba2320c341d89
SHA256960babaf1b9614390934a6524e9b98482172603fe0fb9582f7111812457057d0
SHA51253e2de4c32180fdfcea4c60866987e63c7d2d1edbefc1e39337aacb8e9bad74bba7a979ab5254187b8b9dd8feac0047baf6b6db54580d0b86c996a65cd18cf3e
-
Filesize
101KB
MD50c13a581771e783447df8f9576093750
SHA1d32e57b8c2233ab0b41ba71d6ec9822c6e9c1dc7
SHA2568efc91f24b4e2c693ee861b4feaba9677fc8251824a3dc220c199050dcbdd44a
SHA51252c0e7901c5a7a4309e2468c4232d82c667ac935ecd0cec16c18e885af73380158a9bfac0f508808165dfd664e08cd63e1a896a4da8bdd61a511d9d973ea9662
-
Filesize
101KB
MD5da4d033eda3b217cdaba990594ad730b
SHA11c7f4f832f4a471fcf66504be6b5f0a58c2abde4
SHA256c8a6c7bdbf1650533d3de1451c126b375ae94a3994212e86ff3c89f07d59cbdc
SHA512b716f1782ffe38eef8b9c7cc330cc50e746d5df2971aad15778a4d3d0fdff19724f5b4e86b2e7dc75507eeb5a74fd3eb456858474e241ca3810bda2c79fb7c32
-
Filesize
101KB
MD542ec97afbf171684e6838755cbaccd50
SHA1f9ede752a7488b8176ac5e5beafe90e92f2cfa0c
SHA2568a15239caf776118dc2027312a591ad9264c55798ac3fd77bc9e11bde5ca0625
SHA5125c0c0124e3b679aeb43cf20b315711b7e288576b64d0f26f316f554ce5d0c698f5e070fc97b8cb8c48f520cb462bc79d00ba555ab988533a87e4f26028620218
-
Filesize
101KB
MD5b52e504e66f5a4453cbccab3d4b19681
SHA174e4298a72d0232e1a4481c0d97c365e90daaabb
SHA25617ebba7e74065e56e79fb0474589cbdf0c0a605d42729419e5ce12aec08df611
SHA512c528538c78f99ac63116c1ec7fbb9293d17c99ae5dc5da562833b8e019d3eb03c0707fc3b0eae10858af78e54be0d5e7e48093f8b6c0938cc774463adcf0cf84
-
Filesize
101KB
MD524a5cc3d966cc23750a90305eef35f12
SHA1086f5b2e7f5d858dc3964f9a8a2276607ee9b080
SHA2568b3a681af28fd9ea1d83bdd6d9c27a732f3cfd9a580d37fdd07fc2433932cf4b
SHA5120052146e373f1f1d8999960d986c5b00245d1843f0f9371ac960bff90bd6e0e79d3c48d71656942ee891e388bb612f43c15994d1eb526a2733fe1fa215c2fdcf
-
Filesize
101KB
MD54590222d2a95182028acb8fa016be2b7
SHA17f31e5613261dd149ade5e5b04afca64e959d99e
SHA25697353403b93fae922da0bacb11c7f90b65b2e20bfdecd51f5ab41d23805caac4
SHA512dcc3855114324cbab9ea7ae189e33c0581a8b2e3f25eab720a35bb3ea46a0afb29833919128140df6c30066e1f5458e446f1381be8a6a4548474584661faa2b8
-
Filesize
7KB
MD581dca36a164a6307b800cdcb3b4d8309
SHA1cdd3664b97f9952cd9f4f53059f46c3bacdbc0d5
SHA256530f38ca8f79c4e75ba729f9ed6b6e0622811f884ce464d32a2b9cf8ebc05084
SHA512e1da4cc6b31beab882a5af698375d1577a912c8ade42055be6cfec229735b6dbd13327e61e9347a63537e5b4039a03ff54dcdaf0f8d0f50928507d3d10ca1db8