977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
Size

669KB
MD5

42e7736a8ea9bbdc2e80622e46659f51
SHA1

7563cbcda6f7f7e47f27aa267f0341467d4fd02e
SHA256

977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68
SHA512

8f4032205a16e574ab7ea689aea46f09f955aa125ddf14c23c4293442b4aa3e32015d8fadc03e9d2011fbef2a08e1e1bbcb3137743d51c08f8eb40bfba2f2994
SSDEEP

12288:H//DzeVKhMpQnqr+cI3a72LXrY6x46UbR/qYglMi:HDqchMpQnqrdX72LbY6x46uR/qYglMi

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Delnin32.exe

Executes dropped EXE 18 IoCs

pid	Process
2820	Bfhhoi32.exe
2160	Bnpppgdj.exe
4448	Banllbdn.exe
388	Chjaol32.exe
2068	Cndikf32.exe
2844	Cnffqf32.exe
4904	Cfbkeh32.exe
752	Chagok32.exe
636	Cmnpgb32.exe
3012	Cnnlaehj.exe
3256	Ddjejl32.exe
1900	Danecp32.exe
2812	Dhhnpjmh.exe
2764	Delnin32.exe
2196	Dodbbdbb.exe
564	Dfpgffpm.exe
2796	Deagdn32.exe
4932	Dmllipeg.exe

Drops file in System32 directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Agjbpg32.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Delnin32.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Delnin32.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Cmnpgb32.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Danecp32.exe	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Bfhhoi32.exe	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
File created	C:\Windows\SysWOW64\Qihfjd32.dll	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Ghekjiam.dll	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Gmcfdb32.dll	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Cnffqf32.exe	Cndikf32.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Cnnlaehj.exe
File opened for modification	C:\Windows\SysWOW64\Dhhnpjmh.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Delnin32.exe
File created	C:\Windows\SysWOW64\Cndikf32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Cnffqf32.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Cndikf32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Chagok32.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Bnpppgdj.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Cnnlaehj.exe	Cmnpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Chagok32.exe	Cfbkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Deagdn32.exe	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cndikf32.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Dfpgffpm.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Fqjamcpe.dll	Chjaol32.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Cndikf32.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Dhhnpjmh.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
File created	C:\Windows\SysWOW64\Jfihel32.dll	Banllbdn.exe
File created	C:\Windows\SysWOW64\Dhhnpjmh.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dfpgffpm.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Cmnpgb32.exe	Chagok32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Ddjejl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1784	4932	WerFault.exe	106

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmnpgb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dodbbdbb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dfpgffpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Deagdn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bfhhoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Banllbdn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnffqf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnnlaehj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnpppgdj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddjejl32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhhnpjmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Delnin32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cndikf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chjaol32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmnpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekjiam.dll"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qlgene32.dll"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmcfdb32.dll"	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kahdohfm.dll"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingfla32.dll"	Cmnpgb32.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2820	2352	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe	86
PID 2352 wrote to memory of 2820	2352	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe	86
PID 2352 wrote to memory of 2820	2352	977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe	86
PID 2820 wrote to memory of 2160	2820	Bfhhoi32.exe	87
PID 2820 wrote to memory of 2160	2820	Bfhhoi32.exe	87
PID 2820 wrote to memory of 2160	2820	Bfhhoi32.exe	87
PID 2160 wrote to memory of 4448	2160	Bnpppgdj.exe	88
PID 2160 wrote to memory of 4448	2160	Bnpppgdj.exe	88
PID 2160 wrote to memory of 4448	2160	Bnpppgdj.exe	88
PID 4448 wrote to memory of 388	4448	Banllbdn.exe	89
PID 4448 wrote to memory of 388	4448	Banllbdn.exe	89
PID 4448 wrote to memory of 388	4448	Banllbdn.exe	89
PID 388 wrote to memory of 2068	388	Chjaol32.exe	90
PID 388 wrote to memory of 2068	388	Chjaol32.exe	90
PID 388 wrote to memory of 2068	388	Chjaol32.exe	90
PID 2068 wrote to memory of 2844	2068	Cndikf32.exe	91
PID 2068 wrote to memory of 2844	2068	Cndikf32.exe	91
PID 2068 wrote to memory of 2844	2068	Cndikf32.exe	91
PID 2844 wrote to memory of 4904	2844	Cnffqf32.exe	92
PID 2844 wrote to memory of 4904	2844	Cnffqf32.exe	92
PID 2844 wrote to memory of 4904	2844	Cnffqf32.exe	92
PID 4904 wrote to memory of 752	4904	Cfbkeh32.exe	93
PID 4904 wrote to memory of 752	4904	Cfbkeh32.exe	93
PID 4904 wrote to memory of 752	4904	Cfbkeh32.exe	93
PID 752 wrote to memory of 636	752	Chagok32.exe	94
PID 752 wrote to memory of 636	752	Chagok32.exe	94
PID 752 wrote to memory of 636	752	Chagok32.exe	94
PID 636 wrote to memory of 3012	636	Cmnpgb32.exe	95
PID 636 wrote to memory of 3012	636	Cmnpgb32.exe	95
PID 636 wrote to memory of 3012	636	Cmnpgb32.exe	95
PID 3012 wrote to memory of 3256	3012	Cnnlaehj.exe	96
PID 3012 wrote to memory of 3256	3012	Cnnlaehj.exe	96
PID 3012 wrote to memory of 3256	3012	Cnnlaehj.exe	96
PID 3256 wrote to memory of 1900	3256	Ddjejl32.exe	98
PID 3256 wrote to memory of 1900	3256	Ddjejl32.exe	98
PID 3256 wrote to memory of 1900	3256	Ddjejl32.exe	98
PID 1900 wrote to memory of 2812	1900	Danecp32.exe	100
PID 1900 wrote to memory of 2812	1900	Danecp32.exe	100
PID 1900 wrote to memory of 2812	1900	Danecp32.exe	100
PID 2812 wrote to memory of 2764	2812	Dhhnpjmh.exe	101
PID 2812 wrote to memory of 2764	2812	Dhhnpjmh.exe	101
PID 2812 wrote to memory of 2764	2812	Dhhnpjmh.exe	101
PID 2764 wrote to memory of 2196	2764	Delnin32.exe	103
PID 2764 wrote to memory of 2196	2764	Delnin32.exe	103
PID 2764 wrote to memory of 2196	2764	Delnin32.exe	103
PID 2196 wrote to memory of 564	2196	Dodbbdbb.exe	104
PID 2196 wrote to memory of 564	2196	Dodbbdbb.exe	104
PID 2196 wrote to memory of 564	2196	Dodbbdbb.exe	104
PID 564 wrote to memory of 2796	564	Dfpgffpm.exe	105
PID 564 wrote to memory of 2796	564	Dfpgffpm.exe	105
PID 564 wrote to memory of 2796	564	Dfpgffpm.exe	105
PID 2796 wrote to memory of 4932	2796	Deagdn32.exe	106
PID 2796 wrote to memory of 4932	2796	Deagdn32.exe	106
PID 2796 wrote to memory of 4932	2796	Deagdn32.exe	106

C:\Users\Admin\AppData\Local\Temp\977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe
"C:\Users\Admin\AppData\Local\Temp\977e923daf30492bb602e2ed88830acb9aa7b4d055b1562e95746383e640ee68.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\Bfhhoi32.exe
  C:\Windows\system32\Bfhhoi32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\Bnpppgdj.exe
    C:\Windows\system32\Bnpppgdj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Windows\SysWOW64\Banllbdn.exe
      C:\Windows\system32\Banllbdn.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:388
      - C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 408
        20⤵
        Program crash
        
        PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4932 -ip 4932
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Banllbdn.exe

Filesize
669KB

MD5
65b90fad62ebd10eb8b3207be9bebaca

SHA1
67ac628693f07b0e1ec18e1c3f1984fe7dae7058

SHA256
52207af82180d39103f44f1725a5e931655df4c0724c2b472c05e421527a3b99

SHA512
b6231b8a6cb473afe560fcaa28587869c437b396490dee592c4a9616fdc0092357dc7e94ab75c1ec7716247472f1f3d292d9d8a04b4d01e317d75328f5319d83

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
669KB

MD5
2aacbd347e7e92ecf264fa015cf25217

SHA1
ee72d37eb88f004339958574f70f85776f3c6d3e

SHA256
6ec405cd757a1ccbb5abf76a3cbc05e386436c3ec9fc2bcf65bcccfe37add973

SHA512
ea3723abd4716bee53a50280befe4eb6a11271eae2d794dfe3305f81d5362f511b6f5d326ca971542692f5c815cdbea9babf78f0f49e8007a25af3561501ae93

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
669KB

MD5
ac0e489b86bb2366f9be4dec989bca52

SHA1
c1a8d6c8a08e0954ca4232bfc4f4f3f08b83f1ba

SHA256
abbd18b8acc2d95de9308c48e4e8f237726f4faaff15744d18b55bb2698bffd7

SHA512
83167b49db1a6353710c7b3ca335b912beab1941f813002b46287b2ab2545b6f74a3e15ad4ba94fea08d0ef6fa5890d951f413b681d33598003decc95a1ae517

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
669KB

MD5
89a5e07e123fbebc3b6e388b631ef4ce

SHA1
6b977292f404ce609abe3f95ae4654c6e48b21c9

SHA256
272750693d25ccb640dd7b23355a82d6c1f5125c81b36236d93cdf46d206200c

SHA512
31a5cdb8e44db19568940f744c62acd157ae89f4a67fc0d1a38d003bdbe9c63c3e6fc9fc656589207056b3264b566bc5582e2e8da4ee5bbf58dc730ecd990314

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
669KB

MD5
398b5684330fb6510d1f76419f43549a

SHA1
52368899b415c33670e003cd56644ed7df18f5e3

SHA256
ef3f233245df60642549beaf6c9ba406e2dcfe6831b0c0e6b91d4a41dff2f722

SHA512
0cb1f5dbd7bb0e1fbe185bcd64033a26e885255f3e8384a0f2897e146057400984cfee4c351a05e85d5dcc14510c59bb14e3c00904e9c99aeeb782e580505407

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
669KB

MD5
d16dc7229db29c378ad1340192028305

SHA1
3adc77af6dda83e28b8f15045b775d32d21af6a3

SHA256
92571d219791446ce52ca37a64bdb108fa69d6590ef9d4c26b43925b898f67e0

SHA512
85a11fa1571ff97af4c120d24862638e2ac5c2944851f5249d06fff258a69006c18fadb755e3843bbfa113dbb6395122b319685a51a7786942af8421b233a1e7

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
669KB

MD5
8d6b1ac5affebf2df8d97e7a5c72410d

SHA1
6f63a57235b64bc910c4c35c8663a9fa2a2e5bf1

SHA256
927ceee240af2dbf83b2a7b4e7c3c063ac6aa3126bb85cf718194081444b6521

SHA512
8f86aaee44d919440ffd2300733ca21e9de6be6777ebef5cfe33399a9bc55582b49fac75989f7b2f3c9472e925acd4733fa4a7b175e52e9fff077babe894d43e

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
669KB

MD5
b3f60adfaf001cdfe8112910227adc98

SHA1
6cac1e8ec02338182f54e69a0be1b89657a1bf34

SHA256
264cb1bfeceb4183851ee17f8f9b880c79bdb6f8e0043cb22da15355a05d669e

SHA512
e9409f6f968d8814d5b3fd02a3d5c82146948222e6ff70926bd6283d019bedd2326aa5a1d60f2301315882ace8806dbe2fd30fd0a044bdd1cb40601f7e8073ba

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
669KB

MD5
77bf90a2c76776b54169203c23f1015f

SHA1
c459b0f0a1608b947f2d566047a052fc2844dfe7

SHA256
e2c510b0e08c82590e7baac4ce63a1b3367e929c8c8d37ba31f08291ae4a8c57

SHA512
af50f32491e95813a2e366ec48158cd8d768ba278fd04d70d4139889b728ac83b49c2eb4ad95e6920c373a7437739f9f2c9f31b74a608f8530f308ea8102a7e5

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
669KB

MD5
16db025eda6ce4e8b02d91e51f99c0c7

SHA1
c1d59fe512a5c695f4d4ea17f276af154ce52f7b

SHA256
e110f552a7f13b7de20032b7b994045cac0995bfced0a083c6549a127c49c5fa

SHA512
5161cdbd950380617ad192925961ea06fc7bc8f2648fdf183cec9377faa896fc7a664d4ab58255abcc49355fa4728c093ce1e0dbbda91857334ec8867a04a04b

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
669KB

MD5
5501f652e699449562f09a9e5a045f63

SHA1
2b27d5bada2986151e2b7d294969ce195f80d083

SHA256
cb05f963b3af5665ec8d958f1874bdf5009577955322b583aabce6bc7667bba6

SHA512
f6b85d280bfeb1a61a8801a8fdb89458cceac6bf707137841f887240002378ceec411274da6922dd0c5ac6d20dbe9c5d3bb8d8b2d3ad8db7c79ab0041863c905

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
669KB

MD5
dbf375377322c987700d89b41f98f9f1

SHA1
5707732b8ec270cc26f0d5aafdb2716f79a0223e

SHA256
c99ad8f215b1e8daca4b240394dfcc84491139670c43f7b5d6b4c5884e9ec222

SHA512
3924dd95e3e92774c77db89ebdc7ea47750eee6f0fc6364706e1bc48b8a220fa91dbc8dae9b8549879996e5ca31324ea3cb64aa45d5392ac7d990d5e5c63ef61

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
669KB

MD5
5539bdb1e46825910750b0a05d4aa84c

SHA1
702edb2f0ad68dc4b5bbde01bbddfc183e982987

SHA256
fe41cb8fe4e395ca19df8c85c80a203d22d2f5d10ebaa7047668366f2b50d98c

SHA512
f90318127950493bb93a1dac8b90392a83d36748091835eedf970452fed50ab88cecebbdae11bebf10badafefa31cafab65e1714c19a9be00bdebfe4d0bf1e31

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
669KB

MD5
fc6dc7b25cdc33999d1094e880392bab

SHA1
2fc6a128b5eb690e7c220ef2a0df77d353d86829

SHA256
b1ddefdcc69165b7abeda82bf9457713246a83a2c6ce104f7b2cd57920e69b8f

SHA512
46760289891b0d6d3c928dd53054e09d3301792376fceb9e12331142b77b5eeb33fa01f57e33b11278751aba72f9bd735870c5617ffbd4cbeba344bcea2751b2

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
669KB

MD5
b3ca6fa04f82e0ce7919cb45ac2ddbdf

SHA1
05de5f13e27d2cac348683afbca8e25c10e96336

SHA256
cc2015857ae419faa3c20c40d70837bac3573f66245f34af7cc0f67dbe33a13e

SHA512
f2d700c7f8ca624690fd2f997635313b93a701ed6584c9d53692aa5b43562aeeb5f946af0bf87632919743737c3420b0242688450a3ae6ddfb603aaa052e87cc

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
669KB

MD5
f450620b7ace5a9c4f7a13aab3777a7a

SHA1
656ca26edbc8bdc2d4cabb5be53c122e2f27a915

SHA256
94cea5b07325f28bc9d1ca260daf184d50e657208511989816d1df18c6b1167b

SHA512
52eedd6772c36189aeb7e36d99e375913ec3426148ecea539f7b03e29e91a53fa20ffaf4eaa3186d5da18857283873c9a4d9240a12dc59fac7d208ffc13409c4

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
669KB

MD5
efd683eef066864d7872daf88ce2e01d

SHA1
ac02829e3d18506a1b400cb78252a752be3f8faa

SHA256
b4305207b81c56a5691a015e930cacbba97010f0b6513a128d9ec7eb5af15756

SHA512
27440cd0a412eadabb64059e36a672e978cd0136f42ce1c3eff6c2355295d585d8a257677c7e375091bbd71c69ee16f00b30de9e4427ea2680d139de23c55dd4

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
669KB

MD5
55725d2bfe377079c8426bada0aead3e

SHA1
9fcd5a3fba9be94626f21745e2b168d7c96b2c2c

SHA256
fe35931ca803e43d21cf966363e8956cc196b9ba97b25946e1bafa9b65702c26

SHA512
34d24073cf232672c6853cac79bbd5f3e7c2aca71127eb748c717f56ae45b0a04f8838e63107c93c6d8aac7fbe439f7c8118c033a4448c7297f19d5c64c731ce

Download Submit
C:\Windows\SysWOW64\Dodbbdbb.exe

Filesize
669KB

MD5
8251bc9023914f3b1532d079a29144ff

SHA1
04d4fb0348c4f850311d26cfe9a75556d790ff96

SHA256
dae42d4a1944a6b87c68db7da310b648b5124bde831d85c97a4db1177d12fd41

SHA512
80d2b7b6c458ce9283cfe27053f398ea94230daa6eb291e40cab59d1ca802f180c58d39fa8a2ea6dd72ed0186600ba0dc302eed03dffc1903540c551c217ba2d

Download Submit
C:\Windows\SysWOW64\Fqjamcpe.dll

Filesize
7KB

MD5
ccad7743fee9e5af0107c79167ae03cf

SHA1
b04f491b82e9e1ea4cf59abd4685f6835c5c2d74

SHA256
003de7bdbe3ea8a0339b5c5d7af6087d665f4dba015117fdf09bbff9adbefaaa

SHA512
1500dd64e5285e12e07bc908c256e9003fd1fa467b9aed90f0c56ab7f12207e28145a03d2dd06dcb7180dae4c42b46e303c8339da1dea19f3fa7f8bc2144f4ab

Download Submit
memory/388-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/388-171-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/564-150-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/564-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/636-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/636-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/752-163-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/752-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1900-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1900-156-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2068-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2068-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2160-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2160-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2196-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2196-149-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2352-179-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2764-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2764-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2796-146-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2796-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2812-154-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2812-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2820-177-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2844-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2844-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3012-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3012-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3256-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3256-158-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-173-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4904-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4904-165-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4932-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4932-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads