Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/08/2024, 16:17
Static task
static1
Behavioral task
behavioral1
Sample
12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe
Resource
win10v2004-20240802-en
General
-
Target
12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe
-
Size
124KB
-
MD5
12cf2a3cdcf3d27f8aac0a570a74f5e0
-
SHA1
71c560d49676689c67f9afda6fe39aa905556d68
-
SHA256
6bf159edcbe127182afd6333eff7d10c473dfe706182d45869a466a7b14eea48
-
SHA512
64073906e0e1d0a767184c3a3e05d5b29ad4ca4acc6cb1d71ecb3fb70ed543175a259dfb9b9ca8e5747bd57fe50d4fc40c346f66a8318d27f211befaf080ce02
-
SSDEEP
1536:23szH5YUhRO/N69BH3OoGa+FL9jKceRgrkjSo:eGZYUhkFoN3Oo1+F92S
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 34 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hpxeq.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" seuxag.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" wuimeuc.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zuiho.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" koeiw.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" deesit.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cqcaep.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" degiy.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jaosoa.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bauocaw.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" keexoi.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kaaafi.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" touul.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" deaitud.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zoule.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jiiame.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gzmoov.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xpkug.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lcfouk.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ruwiv.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fwloz.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" geiruuv.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lxpauw.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" xiecil.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kaequr.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gaeam.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" teojue.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" guoib.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" houiwe.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" puiebig.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jooeva.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ruceq.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cauomey.exe -
Checks computer location settings 2 TTPs 34 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation gaeam.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation touul.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation deesit.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation seuxag.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation cqcaep.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation koeiw.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation jooeva.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation degiy.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation cauomey.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation hpxeq.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation guoib.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation gzmoov.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation zuiho.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation lxpauw.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation teojue.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation zoule.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation puiebig.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation keexoi.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation fwloz.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation bauocaw.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation wuimeuc.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation kaequr.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation lcfouk.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation kaaafi.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation houiwe.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation xiecil.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation ruwiv.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation xpkug.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation geiruuv.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation jaosoa.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation jiiame.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation deaitud.exe Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation ruceq.exe -
Executes dropped EXE 34 IoCs
pid Process 5068 hpxeq.exe 2180 kaaafi.exe 3744 gaeam.exe 3204 teojue.exe 4820 guoib.exe 4520 houiwe.exe 3604 touul.exe 112 jaosoa.exe 116 bauocaw.exe 4392 zoule.exe 1676 puiebig.exe 536 jooeva.exe 5076 seuxag.exe 4992 wuimeuc.exe 3240 keexoi.exe 3124 jiiame.exe 3136 deesit.exe 4108 gzmoov.exe 1728 xiecil.exe 4084 ruwiv.exe 5020 deaitud.exe 3636 kaequr.exe 3720 zuiho.exe 3468 cqcaep.exe 468 fwloz.exe 1004 ruceq.exe 2744 koeiw.exe 3260 xpkug.exe 4568 lcfouk.exe 4172 geiruuv.exe 3328 degiy.exe 1276 lxpauw.exe 232 cauomey.exe 5036 ciakuep.exe -
Adds Run key to start application 2 TTPs 34 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lxpauw = "C:\\Users\\Admin\\lxpauw.exe /M" degiy.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zoule = "C:\\Users\\Admin\\zoule.exe /e" bauocaw.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deaitud = "C:\\Users\\Admin\\deaitud.exe /r" ruwiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqcaep = "C:\\Users\\Admin\\cqcaep.exe /E" zuiho.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\touul = "C:\\Users\\Admin\\touul.exe /X" houiwe.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\deesit = "C:\\Users\\Admin\\deesit.exe /P" jiiame.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zuiho = "C:\\Users\\Admin\\zuiho.exe /R" kaequr.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hpxeq = "C:\\Users\\Admin\\hpxeq.exe /m" 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\degiy = "C:\\Users\\Admin\\degiy.exe /w" geiruuv.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\koeiw = "C:\\Users\\Admin\\koeiw.exe /o" ruceq.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaaafi = "C:\\Users\\Admin\\kaaafi.exe /r" hpxeq.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\houiwe = "C:\\Users\\Admin\\houiwe.exe /r" guoib.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gzmoov = "C:\\Users\\Admin\\gzmoov.exe /q" deesit.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xiecil = "C:\\Users\\Admin\\xiecil.exe /g" gzmoov.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ruceq = "C:\\Users\\Admin\\ruceq.exe /d" fwloz.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\guoib = "C:\\Users\\Admin\\guoib.exe /E" teojue.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bauocaw = "C:\\Users\\Admin\\bauocaw.exe /D" jaosoa.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\seuxag = "C:\\Users\\Admin\\seuxag.exe /X" jooeva.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\geiruuv = "C:\\Users\\Admin\\geiruuv.exe /Z" lcfouk.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaeam = "C:\\Users\\Admin\\gaeam.exe /D" kaaafi.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\keexoi = "C:\\Users\\Admin\\keexoi.exe /e" wuimeuc.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaequr = "C:\\Users\\Admin\\kaequr.exe /Z" deaitud.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jooeva = "C:\\Users\\Admin\\jooeva.exe /k" puiebig.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jiiame = "C:\\Users\\Admin\\jiiame.exe /E" keexoi.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcfouk = "C:\\Users\\Admin\\lcfouk.exe /F" xpkug.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ciakuep = "C:\\Users\\Admin\\ciakuep.exe /Q" cauomey.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teojue = "C:\\Users\\Admin\\teojue.exe /h" gaeam.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jaosoa = "C:\\Users\\Admin\\jaosoa.exe /K" touul.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\puiebig = "C:\\Users\\Admin\\puiebig.exe /D" zoule.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xpkug = "C:\\Users\\Admin\\xpkug.exe /E" koeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cauomey = "C:\\Users\\Admin\\cauomey.exe /B" lxpauw.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuimeuc = "C:\\Users\\Admin\\wuimeuc.exe /J" seuxag.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ruwiv = "C:\\Users\\Admin\\ruwiv.exe /P" xiecil.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fwloz = "C:\\Users\\Admin\\fwloz.exe /B" cqcaep.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 35 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxpauw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language touul.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language deaitud.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kaaafi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jooeva.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zuiho.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpxeq.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language houiwe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language seuxag.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ciakuep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cqcaep.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language koeiw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gaeam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuimeuc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xiecil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language keexoi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language deesit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kaequr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lcfouk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language degiy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language teojue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bauocaw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zoule.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ruwiv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fwloz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpkug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language geiruuv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaosoa.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language puiebig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jiiame.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cauomey.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language guoib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gzmoov.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ruceq.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4136 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe 4136 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe 5068 hpxeq.exe 5068 hpxeq.exe 2180 kaaafi.exe 2180 kaaafi.exe 3744 gaeam.exe 3744 gaeam.exe 3204 teojue.exe 3204 teojue.exe 4820 guoib.exe 4820 guoib.exe 4520 houiwe.exe 4520 houiwe.exe 3604 touul.exe 3604 touul.exe 112 jaosoa.exe 112 jaosoa.exe 116 bauocaw.exe 116 bauocaw.exe 4392 zoule.exe 4392 zoule.exe 1676 puiebig.exe 1676 puiebig.exe 536 jooeva.exe 536 jooeva.exe 5076 seuxag.exe 5076 seuxag.exe 4992 wuimeuc.exe 4992 wuimeuc.exe 3240 keexoi.exe 3240 keexoi.exe 3124 jiiame.exe 3124 jiiame.exe 3136 deesit.exe 3136 deesit.exe 4108 gzmoov.exe 4108 gzmoov.exe 1728 xiecil.exe 1728 xiecil.exe 4084 ruwiv.exe 4084 ruwiv.exe 5020 deaitud.exe 5020 deaitud.exe 3636 kaequr.exe 3636 kaequr.exe 3720 zuiho.exe 3720 zuiho.exe 3468 cqcaep.exe 3468 cqcaep.exe 468 fwloz.exe 468 fwloz.exe 1004 ruceq.exe 1004 ruceq.exe 2744 koeiw.exe 2744 koeiw.exe 3260 xpkug.exe 3260 xpkug.exe 4568 lcfouk.exe 4568 lcfouk.exe 4172 geiruuv.exe 4172 geiruuv.exe 3328 degiy.exe 3328 degiy.exe -
Suspicious use of SetWindowsHookEx 35 IoCs
pid Process 4136 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe 5068 hpxeq.exe 2180 kaaafi.exe 3744 gaeam.exe 3204 teojue.exe 4820 guoib.exe 4520 houiwe.exe 3604 touul.exe 112 jaosoa.exe 116 bauocaw.exe 4392 zoule.exe 1676 puiebig.exe 536 jooeva.exe 5076 seuxag.exe 4992 wuimeuc.exe 3240 keexoi.exe 3124 jiiame.exe 3136 deesit.exe 4108 gzmoov.exe 1728 xiecil.exe 4084 ruwiv.exe 5020 deaitud.exe 3636 kaequr.exe 3720 zuiho.exe 3468 cqcaep.exe 468 fwloz.exe 1004 ruceq.exe 2744 koeiw.exe 3260 xpkug.exe 4568 lcfouk.exe 4172 geiruuv.exe 3328 degiy.exe 1276 lxpauw.exe 232 cauomey.exe 5036 ciakuep.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4136 wrote to memory of 5068 4136 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe 90 PID 4136 wrote to memory of 5068 4136 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe 90 PID 4136 wrote to memory of 5068 4136 12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe 90 PID 5068 wrote to memory of 2180 5068 hpxeq.exe 93 PID 5068 wrote to memory of 2180 5068 hpxeq.exe 93 PID 5068 wrote to memory of 2180 5068 hpxeq.exe 93 PID 2180 wrote to memory of 3744 2180 kaaafi.exe 95 PID 2180 wrote to memory of 3744 2180 kaaafi.exe 95 PID 2180 wrote to memory of 3744 2180 kaaafi.exe 95 PID 3744 wrote to memory of 3204 3744 gaeam.exe 97 PID 3744 wrote to memory of 3204 3744 gaeam.exe 97 PID 3744 wrote to memory of 3204 3744 gaeam.exe 97 PID 3204 wrote to memory of 4820 3204 teojue.exe 98 PID 3204 wrote to memory of 4820 3204 teojue.exe 98 PID 3204 wrote to memory of 4820 3204 teojue.exe 98 PID 4820 wrote to memory of 4520 4820 guoib.exe 99 PID 4820 wrote to memory of 4520 4820 guoib.exe 99 PID 4820 wrote to memory of 4520 4820 guoib.exe 99 PID 4520 wrote to memory of 3604 4520 houiwe.exe 100 PID 4520 wrote to memory of 3604 4520 houiwe.exe 100 PID 4520 wrote to memory of 3604 4520 houiwe.exe 100 PID 3604 wrote to memory of 112 3604 touul.exe 101 PID 3604 wrote to memory of 112 3604 touul.exe 101 PID 3604 wrote to memory of 112 3604 touul.exe 101 PID 112 wrote to memory of 116 112 jaosoa.exe 103 PID 112 wrote to memory of 116 112 jaosoa.exe 103 PID 112 wrote to memory of 116 112 jaosoa.exe 103 PID 116 wrote to memory of 4392 116 bauocaw.exe 106 PID 116 wrote to memory of 4392 116 bauocaw.exe 106 PID 116 wrote to memory of 4392 116 bauocaw.exe 106 PID 4392 wrote to memory of 1676 4392 zoule.exe 107 PID 4392 wrote to memory of 1676 4392 zoule.exe 107 PID 4392 wrote to memory of 1676 4392 zoule.exe 107 PID 1676 wrote to memory of 536 1676 puiebig.exe 108 PID 1676 wrote to memory of 536 1676 puiebig.exe 108 PID 1676 wrote to memory of 536 1676 puiebig.exe 108 PID 536 wrote to memory of 5076 536 jooeva.exe 109 PID 536 wrote to memory of 5076 536 jooeva.exe 109 PID 536 wrote to memory of 5076 536 jooeva.exe 109 PID 5076 wrote to memory of 4992 5076 seuxag.exe 110 PID 5076 wrote to memory of 4992 5076 seuxag.exe 110 PID 5076 wrote to memory of 4992 5076 seuxag.exe 110 PID 4992 wrote to memory of 3240 4992 wuimeuc.exe 111 PID 4992 wrote to memory of 3240 4992 wuimeuc.exe 111 PID 4992 wrote to memory of 3240 4992 wuimeuc.exe 111 PID 3240 wrote to memory of 3124 3240 keexoi.exe 112 PID 3240 wrote to memory of 3124 3240 keexoi.exe 112 PID 3240 wrote to memory of 3124 3240 keexoi.exe 112 PID 3124 wrote to memory of 3136 3124 jiiame.exe 113 PID 3124 wrote to memory of 3136 3124 jiiame.exe 113 PID 3124 wrote to memory of 3136 3124 jiiame.exe 113 PID 3136 wrote to memory of 4108 3136 deesit.exe 114 PID 3136 wrote to memory of 4108 3136 deesit.exe 114 PID 3136 wrote to memory of 4108 3136 deesit.exe 114 PID 4108 wrote to memory of 1728 4108 gzmoov.exe 115 PID 4108 wrote to memory of 1728 4108 gzmoov.exe 115 PID 4108 wrote to memory of 1728 4108 gzmoov.exe 115 PID 1728 wrote to memory of 4084 1728 xiecil.exe 117 PID 1728 wrote to memory of 4084 1728 xiecil.exe 117 PID 1728 wrote to memory of 4084 1728 xiecil.exe 117 PID 4084 wrote to memory of 5020 4084 ruwiv.exe 118 PID 4084 wrote to memory of 5020 4084 ruwiv.exe 118 PID 4084 wrote to memory of 5020 4084 ruwiv.exe 118 PID 5020 wrote to memory of 3636 5020 deaitud.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe"C:\Users\Admin\AppData\Local\Temp\12cf2a3cdcf3d27f8aac0a570a74f5e0N.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\hpxeq.exe"C:\Users\Admin\hpxeq.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\kaaafi.exe"C:\Users\Admin\kaaafi.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\gaeam.exe"C:\Users\Admin\gaeam.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\teojue.exe"C:\Users\Admin\teojue.exe"5⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\guoib.exe"C:\Users\Admin\guoib.exe"6⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\houiwe.exe"C:\Users\Admin\houiwe.exe"7⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\touul.exe"C:\Users\Admin\touul.exe"8⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\jaosoa.exe"C:\Users\Admin\jaosoa.exe"9⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\bauocaw.exe"C:\Users\Admin\bauocaw.exe"10⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\zoule.exe"C:\Users\Admin\zoule.exe"11⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\puiebig.exe"C:\Users\Admin\puiebig.exe"12⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\jooeva.exe"C:\Users\Admin\jooeva.exe"13⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\seuxag.exe"C:\Users\Admin\seuxag.exe"14⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\wuimeuc.exe"C:\Users\Admin\wuimeuc.exe"15⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\keexoi.exe"C:\Users\Admin\keexoi.exe"16⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\jiiame.exe"C:\Users\Admin\jiiame.exe"17⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\deesit.exe"C:\Users\Admin\deesit.exe"18⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\gzmoov.exe"C:\Users\Admin\gzmoov.exe"19⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\xiecil.exe"C:\Users\Admin\xiecil.exe"20⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\ruwiv.exe"C:\Users\Admin\ruwiv.exe"21⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Users\Admin\deaitud.exe"C:\Users\Admin\deaitud.exe"22⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\kaequr.exe"C:\Users\Admin\kaequr.exe"23⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3636 -
C:\Users\Admin\zuiho.exe"C:\Users\Admin\zuiho.exe"24⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3720 -
C:\Users\Admin\cqcaep.exe"C:\Users\Admin\cqcaep.exe"25⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3468 -
C:\Users\Admin\fwloz.exe"C:\Users\Admin\fwloz.exe"26⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:468 -
C:\Users\Admin\ruceq.exe"C:\Users\Admin\ruceq.exe"27⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1004 -
C:\Users\Admin\koeiw.exe"C:\Users\Admin\koeiw.exe"28⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2744 -
C:\Users\Admin\xpkug.exe"C:\Users\Admin\xpkug.exe"29⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3260 -
C:\Users\Admin\lcfouk.exe"C:\Users\Admin\lcfouk.exe"30⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4568 -
C:\Users\Admin\geiruuv.exe"C:\Users\Admin\geiruuv.exe"31⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4172 -
C:\Users\Admin\degiy.exe"C:\Users\Admin\degiy.exe"32⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3328 -
C:\Users\Admin\lxpauw.exe"C:\Users\Admin\lxpauw.exe"33⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1276 -
C:\Users\Admin\cauomey.exe"C:\Users\Admin\cauomey.exe"34⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:232 -
C:\Users\Admin\ciakuep.exe"C:\Users\Admin\ciakuep.exe"35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
124KB
MD593a114481cfb27d4d37700a3cebf98e3
SHA1b8a4a457983fd19c5c535cc020450e4f8dd5d40a
SHA25633d396c251f77b3b1786bcb898b1c5caf730f3616edaa3f81ed6b5287d8be20f
SHA51267c407221b82fd6d476851ae57a51248aebacedaa649193f852513450696c4a1b34533121889ab233502efa3d08412aa5b3f7eaa81ab6b0783f56595cb2d4dd3
-
Filesize
124KB
MD539bf428d0af8afb6a8752f1f04ca8927
SHA1230eb81abd2ccc50794944e5b7c88095aeffaa15
SHA256ce3cf2f32fd20c11e8b9d9e1133b51e023a50bc5b73e60128368b6b8dbbdd9d3
SHA51237e083f523ca5743548325e178a177aabba9d17d46103c0a4e19cf72119eacf424fe1524b3905f5b5d98a8e4ef684e21527d8a7e94feb2552f79814fc8d71734
-
Filesize
124KB
MD50044de273a8486e0be6ee30b861ca1e3
SHA1a853e4c84a0fd6a6f88f8725db61df8fef9ad1ab
SHA256fd1dddddc53e24602db3bdc335efe4c08a73618f1c1f5a3bbb8fea43fa1f6f61
SHA512fcc2f50b9dd2c4c2060ab5ec8805796aca562b7ea702654723d273417deea86417dfa96743c4bdf44e4b98c4de656d1702ba19e05bd10665e67a279c4c8ad293
-
Filesize
124KB
MD53ab2e4686fa505053d3a96f02d6ba36c
SHA1460f307904c77f3fc62b4f707b1a090796d7cfae
SHA2563d2b8a2c45a30ce2e8ed0074cca1d7a12639fbb8a854595d82495bc244885ba1
SHA512c4e7e4e075eba7ceca82d6c0365b11f29c75dc4f2711383dc68abf4807b459cb012f6f17277d090559c6eaf9d32f2208d6ee06c84c0b86e7708800f06b7dd336
-
Filesize
124KB
MD5178aaa443473a25cfd872caa9f9c9932
SHA1a4839336786c48aed4c435017299d67e78fec60d
SHA25636571db01395dab5c01d6be13f4cabd5603767c7dededfcfb65bc745998c5c75
SHA512c8f45d3755ad426fb9b4aaf0c4160dec10bf799599a473a4355a638d5f19ad877450699e7465522f430e54413b42afc9f21dacfdf434282428a30abd406d810f
-
Filesize
124KB
MD51a37acb35aaf8a8a4207eeaa9a6a295b
SHA1a8249df1d11419302bcb244f1a6c3d13fa3727ff
SHA256a086788fb5c9be01f3d919a70263cbf18ace018995b170e1a9f342acb43a56e2
SHA5122747f51f2e6f5ea9d179924e54a59c6ec8341723347027902de572ba1f2484c821b1d27352618b6459eac718a21c5be95535fd14dfec900fe4cc1e038e88c21a
-
Filesize
124KB
MD5559e9646ab212dce364bbddf7799cd04
SHA1776207ee35b6a8b100885b1fa7968517d9fa1d00
SHA2566c2c5a22acff563726cabdcdcc394f0440971a37641086165aff8e22436cf03f
SHA512cc9d19c9363f5f440e17a8e6efc78001d9aa5c894c43806d35eae27e4b6145aa098764bf81698b294a18f177b05e14fb56d6912bc7bd007b10d2ddfc33ff2b81
-
Filesize
124KB
MD597217688da889ae4a377ea7410b1c117
SHA140cae99015ee4a1e2daf643c2ecc2388e69e99ac
SHA2569af1b90dc496e61416ab3d473a71aafd6487ffac41f069ff75aa253f69caba1c
SHA51236d35ece7f3fc5a907ec677b5c631b6ae8936a46e22dcdbdfc3a2fe0a32fe685b11c5d69982a6c82204b2f346e9af9416878e92c8e0eb7b62a7263ae15b0c1c5
-
Filesize
124KB
MD52ab5cd2d2870926b8c8aab8e0167967a
SHA1cffbcba67d50dd09cdf8da8add3a9e7b097ef99d
SHA256a440dc8c1b722c9dc7921f222880ae81c7d7c20f86fc7195ceaa07602e4def21
SHA512037b1b391a1aa2615f2141d71485fe42cf476ec7b0efe16ac95b32576a4f1ed476e2540ce58f309e63e1939973fbd709516c63eff39b22fce17dffb4f521b0bd
-
Filesize
124KB
MD58610ed5fe9fd0e3de7785372fc7bca38
SHA1eef21c5231e0b9eef87dd51ef32135ae5b328a3c
SHA2565a3ccd1f50baa15471ac635610c98ffe580ffd50202bfa608741545f3f9a887d
SHA512faa080e952ba648768b315e9bb5cfc795fdba3c76d0093acb5f52c4bb682acc91fb35a554efea47f58c58f24dee276e9878b89446b40b4e576c614ed190ef0df
-
Filesize
124KB
MD5a37d33ff235ed09cbd176f37af2d7ff3
SHA16fa5fb765401234e5b26c22a79d2db02f80a6b8f
SHA2563a35f8268108eebc56f8b51a51de8d499b563e376b2f59ba2c9b8b233e2a4358
SHA51209d4ae1cc97a9f198cd1ca2f3398eeb64cf971207c42d33db536a02a4de40838d78c2e2eb76736b9ccf5b070541a5e36b348944aaca78e426b93e4c49144ac2e
-
Filesize
124KB
MD553c5a3021e29783287ad7dbea5ac7d3e
SHA1e756fd2f306eeea027504a84ed2c03cdb3a6bf29
SHA256d0e2df24f844cae91b456ed42831884bdeced74e786cc14da0c66ba1d27dd74b
SHA512c7e2190f091f15393ca989a70aa97730256da812a134c49ff6c8c4b4cd63f78b796f37214274dfe39f738b9cbb6251ac4a65ee08b78414316a3110aa79f4a214
-
Filesize
124KB
MD50affd5b851c2716c0b9abd5cc58c029f
SHA12ade8171db5030f493f5525ea38df2ad81614d1f
SHA2567d198b934e98df155a7f2acde712b1cf7bfe5ceab18da373015eaacedd2dc589
SHA5123340f7eb24e191b4bf8c286f032707645e4184b810afda3d6f210e630060fed03e37580c9cc5c9cd0a8787e777460888911d412d48333faff19395dd35c62c8e
-
Filesize
124KB
MD528d9efe50c52ddf07d40457ee97639f9
SHA1c19cf7f9ee63bd5a44a98e54384452667b055bef
SHA2566fc7907f9b74ab6117b346cfcf7256f0cac25c5baba3cd198dcc1edf4a8df763
SHA5124d722b3a93acf7bb83f3c0a929d0ce646d176ea80120477cd16f44e119d0f2c1899a6343684046612661e24cdfe9895626268985d158b0e1f44cdf4c93c1a172
-
Filesize
124KB
MD52124122d187e500199a90c723f8f30da
SHA106bfeddf90e5682248da507fead679e6057daad9
SHA25653dc153ee7965bc7356774438df3b075840037a4279dad619191bccf0ca623a0
SHA512b6c916e6dd62fe1c845b7b4d0b86670ca9754b468bef0e454d595d6047f828fc4f409b417da09e35fb3ba7ab22d4d4d830891d792e03a38473e3bed2c450ce2c
-
Filesize
124KB
MD537468fcd4b26f172cab460bfcb24e27d
SHA18da43335e14a73f3ec86ad7fd2e3892368ad297d
SHA256c69d313b54a08a29167f0bb7c3227ed9531a3d1a2358072047700350b8b20e56
SHA5129ac1e24b663e402d632071926b0f40944fd747240a57bae14ba2452b9ff62ee01c26f2da0c5c602011b73c769957d65af751be6c937421274c819e5dc897a907
-
Filesize
124KB
MD577a1f3154e0b0de26e70f0250542bf9a
SHA15434be0ccd90c5a39012cf958f3aada391e20018
SHA256f7150c0928169006d2a991b476215a7a1e4787567d167a60c6b0232b2f3bf1f2
SHA512d00d84efb952d5b1c65dc281051e9d00f730dd0cfe9184131f3b6eddcab23839cedcabec37db7dac1f345e9fc846e54218be3065f9fd73a50587225bf83cdb61
-
Filesize
124KB
MD5381e9304fd9f0ac0f25cc889aaec44b6
SHA1867dcc46e72912ed581ab2088849aa1021c8c9ed
SHA256bb92d1b956b764f6a55c0a5413d1c02ceb0aa2f032b42f34cf6767a9fd4f51c1
SHA512d6d0682a00724e923310f18cebb5e4d48308aae1cfa5260a9823a5a28799e5e225f2263b12023d45fcfefbb6fb5e10ca576b1cdf5ef2c5eed285403825848480
-
Filesize
124KB
MD534276c3780909446277afe805510629f
SHA1b2c6aad9cea53aff0899a6495a265e850a2de6ba
SHA25630ba8d75431d0c945ca55004a555979ee6507226aaf921749d05b2673e745572
SHA51273de31a18819464a6af9cf7100fb4c99eec66671599788be148224c28f4b28585e60c9eb4a19f51bd6b2462a5b66af957a87914da980fe0e63c1a916bb8358c3
-
Filesize
124KB
MD59fbcb044371a5858f026803abe6fc90e
SHA1530a6bd9ef0ce3fcef58c7bca1b48dff8db4ea49
SHA256b587ce1a9b84020ba133fefe5517f7c1b8fe7d2cee7b3b7240c596a08af9fac8
SHA5122a1c8d8971d9fea89563c5b5165e83d9cb29f62961947432c2aa2b2dfb71ee52c8258596e1e996a3a02604a880a6a61ed431e439e344c38c8e2be73f7230b8ad
-
Filesize
124KB
MD5133c4be7876df230de178b3bbf371d3a
SHA14120481cb83039e94aaca53fc2a7df6d16785c49
SHA2563f241404b98492d65afcbb9b3a6f79e3286c902828ec57118fc289041899ab2b
SHA512fa2572b7aaf2aa755afcd6d5b7f87afac2ce4e7f18631a8bb4b0be8e7b4995983ad68a5accbbf4d3035345f7f4b83f57cb902c86f76ff24c3fa7126727894d69
-
Filesize
124KB
MD5e5cf8a2a16825fe55df643fb3fb5dcf2
SHA19d29e9346dd281971f20e9c8689d4ed1ade3a558
SHA256076926ae34f938dd74bc3c2907e97b6f2bbc1bc05b769aab3d878fd23df065f8
SHA512fbdc0cde3ef34f4e251ede7f8efb80fd44f7fe6e9d41dfa5642ca7ab4c3f77876c668039622b10ff8b215b4766aec39c55609687fc987332111ed3815520f4c5
-
Filesize
124KB
MD545f3b39c6755e9a6bf6ec2c9693ec0de
SHA16fd962a412c7cc4fdd8ac639af1ced03722cb30b
SHA25638bc5bc89e75038696a5e69d20504a2520875bf134391c671dd0ef9a1c64b35e
SHA5128616acad1fc940f5a4f88016f326673ef54e02d12d6018ed2b40e9c5e8848ea30497f6c906bf23a62bb7292e4a885c23a4aa75d93c81927295b7f801455421c0
-
Filesize
124KB
MD52dc99084b1d639bceb08ddf156fce70e
SHA1fb0cbbdfeb8e2c90cf3a35228bc48a98169ae51a
SHA256a2222e87d444a024563e7f5041de9247ca087e01bc1bdc9b33a64bdb5d1aaf37
SHA51261e59874a630af528e8eb2e257ce990a1eadd3eb9b12a3c7319605d9bdd16d7d9fb74ba9f34bab4faf9e0fb08dd2c2fba7d8ed0e4463e1786403b89ce1d92cbf
-
Filesize
124KB
MD576ce19a2dba53c5aa3d1917e24eb432e
SHA196693a5281fdae859483a8947ee777fd85a3b7ad
SHA256e99f0e835906380ac3bb394dfcf733606b1e7c013c873a09e34b8700b06f38b1
SHA512c7a8629a480180501f88c2ba60cabd7972bf7008e37179d84eada637f75bf528626fc88c975fb78fb4982331fd1dd6313a465964db1839474a5967fd54595e59
-
Filesize
124KB
MD5356d5aa78629242b984909670623f8e3
SHA115e9e41a44548a3803d1991a608eacda58e0223a
SHA2567eb8282b5b266257157c103dc5e1b2d26fe5a5b6bd15ab9963beb2b377907246
SHA512a5edcb097fbb61eb79ad6d363809153ba443053368634a2f2d28ac290a2a14838dd414ac06c7dfc7c7a15b87f502c56c73c8be307ccfa3ca0197a7b4de1febd3
-
Filesize
124KB
MD5c89b00c0a59c64a5b6e7cb786ccceb10
SHA15ab7491f6b18af88b3c7139607bf98beb09c69fe
SHA256574a96e64bd5a77a205abeec7e1f19bf4456e5e3fa163e76cb2d60a800e1e059
SHA512e55bde7b97f22ddb1476a885f6f427674fa86551153283b9b0dc7d1dcb331f429a45caad53b7be930ef469f61f2b3893bb4966b7fcdd8e54b15a3e071f4fb1a8
-
Filesize
124KB
MD5e4854acc22f7e08dcf697137688024b2
SHA1838a8f035f4f45490d021f9d86489c4cac65e4e6
SHA25611ecb107d4da1a53ecb9c593f02f6929cd1c35b8347d8f3e2c44d928c0b90956
SHA51251156cda2930583d751cf83301acd05c61516d0b60e586be316f200f812ef4a460d47ca8559dcfac0eebe1135f6eabc41fbb829854c8aa1c8251ced616185de4
-
Filesize
124KB
MD51d6a1a37542a583110d5d89d0c9cc3da
SHA1388167ba94ebd827d2baca59b26226cd96966ed2
SHA256da192b875a3b27c691d8e904720e38dc0078ef81aac6f6b4550539797e9b167d
SHA512cb6723cc8e2c58a3a1c5ca41f5a66e20ac91da30c238808f837c85d931f0ee1e29d7bd6b3929aa08065fe9e4cf61dcfa154c0d26d13255702eab7ff353f9feb4
-
Filesize
124KB
MD53814fa474b2eac4f5f4ee6c9c967de7c
SHA1545af70b806d3fed496b6d15e08d39e73c057063
SHA256c55b37d152b60fa74379eb0400cadf1ba9bf01ae80f4eeedfa85fcde1d60a2d3
SHA5121955c70cc2dc166b89ac3ae7c62e603158298b5144bab7d8293f9aa830926a90faadeb2fee9f99ee1655af21b8e44356f51bba22e6983a7d1b0b0ab33ef253ed
-
Filesize
124KB
MD5f1f2ae0a15394d6812f16c676016492a
SHA1f6eee8b2b4765cc5e3caa07d012fd59fab602fb4
SHA25624da8ebc9b666f84dee8e6fa15a3693370da0e90552b35b3a69960e90b71b601
SHA51285a65b8e9926b5b96e76504429c3d8b862ce82bac7828d0282c1626b095a962a2b6b3a3fff6f0f99ff9983d40c2803b2ff5f043768f3de5cabe3c51ab3aa8588
-
Filesize
124KB
MD5a28b801d055855a220f0176da6eae784
SHA1c2c4cba2dcaa65b2504bc3704e58929c01810c40
SHA256c5b2348b043ef9caf1bc2067f339012e5ba82f65c06ea81c8221b32ab49a5973
SHA5128440fc292bdbce9016566c4c1c2efc71ddf8044317dd772ddd0324e5403f31e78fe2504c977001305cb2648a4cef76b69ac83fbd971755ab56437345c78f4228