Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
23/04/2024, 06:15
Behavioral task
behavioral1
Sample
ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe
Resource
win7-20240221-en
windows7-x64
27 signatures
150 seconds
General
-
Target
ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe
-
Size
255KB
-
MD5
12853a4f95130cff5e8a6da942f3a09e
-
SHA1
c7008e039107cb07fcdee2b340e31322d70288d4
-
SHA256
ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a
-
SHA512
ca7d731fb0b1f6654371f60ff598929cd1566c52ffd5fb8186f6036906a6d8626283eed4debb75225451f77faa1699910ec1fdb28b0ff34e8ef16aa9e693db3a
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJv:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIU
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" rxcozqkuig.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rxcozqkuig.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rxcozqkuig.exe -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/5032-0-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000800000002341b-5.dat UPX behavioral2/files/0x0007000000023422-28.dat UPX behavioral2/files/0x000800000002341e-27.dat UPX behavioral2/memory/3036-32-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1232-33-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-29-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000300000001e97c-20.dat UPX behavioral2/memory/2848-26-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/5032-35-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1632-48-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000700000002342f-70.dat UPX behavioral2/files/0x000700000002342e-64.dat UPX behavioral2/files/0x0009000000023433-85.dat UPX behavioral2/files/0x0008000000023435-91.dat UPX behavioral2/memory/2848-93-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-94-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1232-95-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-96-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1632-97-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000800000002343d-113.dat UPX behavioral2/memory/2848-121-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/files/0x000800000002343d-125.dat UPX behavioral2/memory/840-190-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-191-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-534-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-535-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1232-545-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1232-548-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1632-547-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-546-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1632-615-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1232-618-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-617-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-616-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-619-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1632-620-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-621-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-622-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-624-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1632-625-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1232-623-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1232-627-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/1632-626-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-628-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-629-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-630-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-631-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-635-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-636-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-639-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-640-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-641-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-642-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-643-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-644-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-645-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-646-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-647-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-661-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-662-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/3036-663-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/2848-673-0x0000000000400000-0x00000000004A0000-memory.dmp UPX behavioral2/memory/840-674-0x0000000000400000-0x00000000004A0000-memory.dmp UPX -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rxcozqkuig.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe -
Executes dropped EXE 5 IoCs
pid Process 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 1232 krchomvn.exe 3036 qqvmpsrrqicfq.exe 1632 krchomvn.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/5032-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000800000002341b-5.dat upx behavioral2/files/0x0007000000023422-28.dat upx behavioral2/files/0x000800000002341e-27.dat upx behavioral2/memory/3036-32-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1232-33-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-29-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000300000001e97c-20.dat upx behavioral2/memory/2848-26-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5032-35-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1632-48-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000700000002342f-70.dat upx behavioral2/files/0x000700000002342e-64.dat upx behavioral2/files/0x0009000000023433-85.dat upx behavioral2/files/0x0008000000023435-91.dat upx behavioral2/memory/2848-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1232-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1632-97-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000800000002343d-113.dat upx behavioral2/memory/2848-121-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000800000002343d-125.dat upx behavioral2/memory/840-190-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-191-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-534-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-535-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1232-545-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1232-548-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1632-547-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-546-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1632-615-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1232-618-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-617-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-616-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-619-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1632-620-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-621-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-622-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-624-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1632-625-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1232-623-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1232-627-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1632-626-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-628-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-629-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-630-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-631-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-635-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-636-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-639-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-640-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-641-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-642-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-643-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-644-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-645-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-646-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-647-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-661-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-662-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3036-663-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2848-673-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/840-674-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rxcozqkuig.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdzexqet = "rxcozqkuig.exe" eykzrrxifiyckws.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wftrzmzf = "eykzrrxifiyckws.exe" eykzrrxifiyckws.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "qqvmpsrrqicfq.exe" eykzrrxifiyckws.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: krchomvn.exe File opened (read-only) \??\s: krchomvn.exe File opened (read-only) \??\a: krchomvn.exe File opened (read-only) \??\i: krchomvn.exe File opened (read-only) \??\o: krchomvn.exe File opened (read-only) \??\b: krchomvn.exe File opened (read-only) \??\p: krchomvn.exe File opened (read-only) \??\v: krchomvn.exe File opened (read-only) \??\z: krchomvn.exe File opened (read-only) \??\y: rxcozqkuig.exe File opened (read-only) \??\r: krchomvn.exe File opened (read-only) \??\w: rxcozqkuig.exe File opened (read-only) \??\r: krchomvn.exe File opened (read-only) \??\o: krchomvn.exe File opened (read-only) \??\i: krchomvn.exe File opened (read-only) \??\u: krchomvn.exe File opened (read-only) \??\h: rxcozqkuig.exe File opened (read-only) \??\h: krchomvn.exe File opened (read-only) \??\h: krchomvn.exe File opened (read-only) \??\i: rxcozqkuig.exe File opened (read-only) \??\m: rxcozqkuig.exe File opened (read-only) \??\l: krchomvn.exe File opened (read-only) \??\q: krchomvn.exe File opened (read-only) \??\x: krchomvn.exe File opened (read-only) \??\a: rxcozqkuig.exe File opened (read-only) \??\z: krchomvn.exe File opened (read-only) \??\b: rxcozqkuig.exe File opened (read-only) \??\e: rxcozqkuig.exe File opened (read-only) \??\j: rxcozqkuig.exe File opened (read-only) \??\s: rxcozqkuig.exe File opened (read-only) \??\g: krchomvn.exe File opened (read-only) \??\q: krchomvn.exe File opened (read-only) \??\p: rxcozqkuig.exe File opened (read-only) \??\v: rxcozqkuig.exe File opened (read-only) \??\w: krchomvn.exe File opened (read-only) \??\j: krchomvn.exe File opened (read-only) \??\s: krchomvn.exe File opened (read-only) \??\v: krchomvn.exe File opened (read-only) \??\a: krchomvn.exe File opened (read-only) \??\t: rxcozqkuig.exe File opened (read-only) \??\b: krchomvn.exe File opened (read-only) \??\y: krchomvn.exe File opened (read-only) \??\r: rxcozqkuig.exe File opened (read-only) \??\y: krchomvn.exe File opened (read-only) \??\q: rxcozqkuig.exe File opened (read-only) \??\u: rxcozqkuig.exe File opened (read-only) \??\p: krchomvn.exe File opened (read-only) \??\o: rxcozqkuig.exe File opened (read-only) \??\l: krchomvn.exe File opened (read-only) \??\m: krchomvn.exe File opened (read-only) \??\x: krchomvn.exe File opened (read-only) \??\n: krchomvn.exe File opened (read-only) \??\e: krchomvn.exe File opened (read-only) \??\z: rxcozqkuig.exe File opened (read-only) \??\m: krchomvn.exe File opened (read-only) \??\t: krchomvn.exe File opened (read-only) \??\u: krchomvn.exe File opened (read-only) \??\w: krchomvn.exe File opened (read-only) \??\g: krchomvn.exe File opened (read-only) \??\k: rxcozqkuig.exe File opened (read-only) \??\n: rxcozqkuig.exe File opened (read-only) \??\x: rxcozqkuig.exe File opened (read-only) \??\j: krchomvn.exe File opened (read-only) \??\k: krchomvn.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" rxcozqkuig.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" rxcozqkuig.exe -
AutoIT Executable 62 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3036-32-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1232-33-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-29-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-26-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5032-35-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1632-48-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-93-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1232-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1632-97-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-121-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-190-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-191-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-534-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-535-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1232-545-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1232-548-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1632-547-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-546-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1632-615-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1232-618-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-617-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-616-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-619-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1632-620-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-621-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-622-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-624-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1632-625-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1232-623-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1232-627-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1632-626-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-628-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-629-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-630-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-631-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-635-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-636-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-639-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-640-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-641-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-642-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-643-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-644-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-645-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-646-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-647-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-661-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-662-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-663-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-673-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-674-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-675-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-676-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-677-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-678-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-679-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-680-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3036-681-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2848-682-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/840-683-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\rxcozqkuig.exe ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe File opened for modification C:\Windows\SysWOW64\krchomvn.exe ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification C:\Windows\SysWOW64\rxcozqkuig.exe ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe File created C:\Windows\SysWOW64\eykzrrxifiyckws.exe ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe File opened for modification C:\Windows\SysWOW64\eykzrrxifiyckws.exe ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe File created C:\Windows\SysWOW64\krchomvn.exe ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe File created C:\Windows\SysWOW64\qqvmpsrrqicfq.exe ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe File opened for modification C:\Windows\SysWOW64\qqvmpsrrqicfq.exe ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll rxcozqkuig.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe krchomvn.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe krchomvn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe krchomvn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe krchomvn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal krchomvn.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe krchomvn.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe krchomvn.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe krchomvn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal krchomvn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal krchomvn.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe krchomvn.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe krchomvn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe krchomvn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal krchomvn.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe krchomvn.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe krchomvn.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe krchomvn.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe krchomvn.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe krchomvn.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe krchomvn.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe krchomvn.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe krchomvn.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe krchomvn.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe krchomvn.exe File opened for modification C:\Windows\mydoc.rtf ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe krchomvn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F89FCF94F26851C9047D65D7E97BCEFE633593767446341D6EC" ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe Key created \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000_Classes\Local Settings ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" rxcozqkuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" rxcozqkuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC0B028479439EA53B8BAA63393D7C8" ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh rxcozqkuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc rxcozqkuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" rxcozqkuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf rxcozqkuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" rxcozqkuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" rxcozqkuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs rxcozqkuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg rxcozqkuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32412D0B9C5183506D3677D170562DDB7D8764DE" ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACFF9BDF966F293840B3A4381EC3998B08902FD4261033AE1C545E709A9" ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7836BB1FF6E21DDD178D1D68A7C9011" ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC60C14E6DBC0B9CE7CE9EC9434CF" ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat rxcozqkuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" rxcozqkuig.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1796 WINWORD.EXE 1796 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 2848 rxcozqkuig.exe 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 840 eykzrrxifiyckws.exe 2848 rxcozqkuig.exe 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 840 eykzrrxifiyckws.exe 2848 rxcozqkuig.exe 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 840 eykzrrxifiyckws.exe 1232 krchomvn.exe 1232 krchomvn.exe 1232 krchomvn.exe 1232 krchomvn.exe 1232 krchomvn.exe 1232 krchomvn.exe 1232 krchomvn.exe 1232 krchomvn.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 1632 krchomvn.exe 1632 krchomvn.exe 1632 krchomvn.exe 1632 krchomvn.exe 1632 krchomvn.exe 1632 krchomvn.exe 1632 krchomvn.exe 1632 krchomvn.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 2848 rxcozqkuig.exe 2848 rxcozqkuig.exe 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 840 eykzrrxifiyckws.exe 840 eykzrrxifiyckws.exe 1232 krchomvn.exe 1232 krchomvn.exe 1232 krchomvn.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 1632 krchomvn.exe 1632 krchomvn.exe 1632 krchomvn.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 2848 rxcozqkuig.exe 2848 rxcozqkuig.exe 2848 rxcozqkuig.exe 840 eykzrrxifiyckws.exe 840 eykzrrxifiyckws.exe 840 eykzrrxifiyckws.exe 1232 krchomvn.exe 1232 krchomvn.exe 1232 krchomvn.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 3036 qqvmpsrrqicfq.exe 1632 krchomvn.exe 1632 krchomvn.exe 1632 krchomvn.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE 1796 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 5032 wrote to memory of 2848 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 89 PID 5032 wrote to memory of 2848 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 89 PID 5032 wrote to memory of 2848 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 89 PID 5032 wrote to memory of 840 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 90 PID 5032 wrote to memory of 840 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 90 PID 5032 wrote to memory of 840 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 90 PID 5032 wrote to memory of 1232 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 91 PID 5032 wrote to memory of 1232 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 91 PID 5032 wrote to memory of 1232 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 91 PID 5032 wrote to memory of 3036 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 92 PID 5032 wrote to memory of 3036 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 92 PID 5032 wrote to memory of 3036 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 92 PID 5032 wrote to memory of 1796 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 93 PID 5032 wrote to memory of 1796 5032 ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe 93 PID 2848 wrote to memory of 1632 2848 rxcozqkuig.exe 95 PID 2848 wrote to memory of 1632 2848 rxcozqkuig.exe 95 PID 2848 wrote to memory of 1632 2848 rxcozqkuig.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe"C:\Users\Admin\AppData\Local\Temp\ffc622972c864d3ab2d50da36249589d20ed55266dd759076c87b11f96d0ab8a.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\rxcozqkuig.exerxcozqkuig.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\krchomvn.exeC:\Windows\system32\krchomvn.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1632
-
-
-
C:\Windows\SysWOW64\eykzrrxifiyckws.exeeykzrrxifiyckws.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:840
-
-
C:\Windows\SysWOW64\krchomvn.exekrchomvn.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1232
-
-
C:\Windows\SysWOW64\qqvmpsrrqicfq.exeqqvmpsrrqicfq.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3036
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1796
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD585ef6264528a9027a3ff53b6c8eb9a7d
SHA19c6a9aa766d387c9bf344103a1633299fb728a8b
SHA2568513eea9ef152d511074d39c709705dacda535df07acd9d02b7ad1eab199ea76
SHA51259b66485b0556d55c6ad6df4523c6c598c6a9bb631ed5e058586dbc1f58d9e538a9abec0a48cae86e6f3780cb86426911e68e13ea5bf332d3246c666b10b9539
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
239B
MD52fae0fe44fb67ed515b21a2b6fba40e3
SHA1d39c4cb134c596851c157406149129a69844613b
SHA256bd528b67c4e7b5924426cb6edc6bd85896db3a43e596bc76d32632d33eccc2b1
SHA5129902e514810847d11b83ceb64209c7a363f3b482f5444474673988fa0729295d8612ae6aa0d81a09d9adeb958f7e0251b414ef808f82f279df504bc04a347087
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD529fcaab6e3ae9df2dd96bd4141fba973
SHA1491bf6a13b1c87e32276f837152db6289aed966e
SHA2566457e794d739c92449ccc462ac6c12010018c5f88d3418e86188b90a0f8543af
SHA512451f8bfc378b290446c6bc11bbc99c1ccc2ec3d2e7cb7ed4b0bf067b6925cf474e12b99640fc43d16d893d931b6af8d04a0e925dc83f7dad9ee6ead0f7870274
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5ce294feeb087858634534811bae676eb
SHA1672e9c8bbb6b474ca12011512a48e076977fa48c
SHA256d5eee8ecd43c277b09f4bc8709d51e0b107330af9fecdef50e0a18ebe5c17431
SHA5120d7990e13bbd1a7f89397290bc09cf014eb05835d0edc2a69be11b6814220235bcf5817cd4852dab4da26669dd671b228484e3718f94acbc9a3f9eceb633ed5a
-
Filesize
255KB
MD589b5b7b9a3713e58e4d7eb89c38a6e91
SHA10b5fdf322c34dd1fe76e464163baead3137d28d9
SHA256cb8cbd123155b315d43b8f2b736fb490c479dd673b28382130575c92eb293bea
SHA5125300bad1500150e8c5a50adc514ae508a50be2357b1642030d119a71d104c34b7a59f496beabc4238b7530a5aa51323ca6fef9ccf8e09626eff0be296c5fbb7d
-
Filesize
255KB
MD5f2f07c07e46a48d01b5272491d857b16
SHA16ade2e3abbfc6ea90caa60704c27d84e0a9e03ee
SHA256d6cc2493000a1f33ae81fb260208d0ce405ce4dea0a10483306f401927072971
SHA5129e71350b64ef53c869931dc6b40d8893f6ceaebf477e0e5c6f535782d5d2441d4be8dcb2f2638f34fea411496e9f399f8186fac0ee786ec77189bf0217b990df
-
Filesize
255KB
MD5beb4c07c21cc70d1dd23e3026b5065ff
SHA17d53e707ac02291d825221eb122f0f91f21870a8
SHA25662c782f6f5492d5cdce9be8c651e03900cd9e6411770028f464d71d366a4edd9
SHA512176162ca6128f3ebe66a43043b7c81bf00d8d307d047663d419abb67a6972d845907b5b75d546c77b1ce0c1ac85357f98547f046efb3f10c184bbd26f790e499
-
Filesize
255KB
MD5ae201b8108dd21a9214070a06ffcc202
SHA1ccf92d3878dd58e08769740f96e3654e9beae5d5
SHA256c7a6c2cd3f5469770611c492ee1c7507a012ea23c05106272964036e01210967
SHA5125cdf984b5577631495e7fa4619dc3e3a9c9c5ea8833bdee873df544d436e99c500b5358d39471b9f7cebb527c8186408e799aa9ebc6a42e84726ecb655865d9f
-
Filesize
255KB
MD56b5f9c7592c5d105233420e4d40f03b8
SHA146669acc8e6220f61c10c1e7cb7985b5d4562c31
SHA2560daa6eadda3aab4a6fd13b9156b125901ab69bc6c8eb30accbd9021d673b0359
SHA512885dc26f5b283e8525d94aa0b069d4bd53d008da40a234d38b9135be04d890634cd5615b4aa4c6e3d766c1ede090e3a02db68062bbf6cb92f0cd3ac926939333
-
Filesize
255KB
MD504cb73b5e74cd3d4a4199ca7922e1bc9
SHA14120e01d3971f7c5293bc5160ed363b625f0ad5f
SHA256feeccbbfb63be411d70c5d6e327af7fd5eedd1cd1ce608892cceeb9758b6fe4a
SHA5123b12d7e4f1cbf938c30fee58ddf1ffb38a528af4e73682a0c9749e6d62a2d64d849eb369cdfd1a51b9fa91f6a6b0a05790a56acf308f41be19ae28306ef33e4b
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5910732ec7cc14f474c977ac96b002d03
SHA19938761e311ffd06ab1899446c429e845617f8bd
SHA256347a3bc5b71e6777447063b2550fe338d0ec064f44254781efebd12e7bb924f0
SHA5128acefa0c91869e06727441a3c20ff14e99d34b00507cfb07b0e955fb517b29d1c33baf1fc75c4083c0cc527edcdeb21f1799043ce6bbc6e5d9e9cb913459548d
-
Filesize
255KB
MD5021c13264f4154735695705721053cad
SHA138f0e48b70d1ad1d8729915b1f66241b42500a8c
SHA256eed1788138b3358bf9a8abccc66f60e02718695d7b97052451a25c370c2069a0
SHA51264aa38f939a2f1619c500c57dd4e25fd2662e2ca0ddc4c64c3578af9e9f213bea945683ee1fcfc0d8029bdadbbd09a937acebcd074a966c0353e60e1342837c7
-
Filesize
255KB
MD5fb6ebf3195e23e78b6891f886fc8b1cb
SHA195c2fef8919c46ff0e5c47241003f017420aafa9
SHA2568dd594bc2e87311884d813a9a818c77c4a11dc5a968cfd0bec3087e5afe95c8c
SHA512969fcfacb3c1b110a18d7a008978781be24b57083e5604a60a9cb6feb94989b17d19ea989addf4c4153acf99842fc3fb6dff1456e74f2f4504690ccc0f6c1908