39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8

Analysis

max time kernel
137s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/09/2024, 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
Size

1.0MB
MD5

56cb4177698cacbaf3f194fbc133f3d5
SHA1

6b52cec6871d408f7e71584eea5ea08b103130ad
SHA256

39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8
SHA512

c47813abaa38f4fd758e6d277311a3fcdac317cacee7a852461a10b2e2f90697f9eddfa325a257acc1d086b401770794f38af93ebd7327b006d46e647a171a4a
SSDEEP

12288:Mmhjxw7dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxL5BwcyQVaE:Lhe7alj3DSudvGM3MXTVhtSQWGtxkPQF

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	viqdhzdkrg.exe

Executes dropped EXE 4 IoCs

pid	Process
2344	viqdhzdkrg.exe
2544	gyznnbxlsj.exe
3152	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
3328	bindsvc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0002000000022b23-13.dat	upx
behavioral2/memory/2544-15-0x0000000000320000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/2544-232-0x0000000000320000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/2544-241-0x0000000000320000-0x000000000049A000-memory.dmp	upx

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\bindsvc.exe	gyznnbxlsj.exe
File created	C:\Windows\SysWOW64\wideshut.exe	gyznnbxlsj.exe
File opened for modification	C:\Windows\SysWOW64\wideshut.exe	gyznnbxlsj.exe
File created	C:\Windows\SysWOW64\wimsvc.exe	gyznnbxlsj.exe
File created	C:\Windows\SysWOW64\racfg.exe	gyznnbxlsj.exe
File created	C:\Windows\SysWOW64\bindsvc.exe	gyznnbxlsj.exe
File created	C:\Windows\system32\msfte.dll	gyznnbxlsj.exe
File created	C:\Windows\system32\oci.dll	gyznnbxlsj.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4384	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bindsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	viqdhzdkrg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gyznnbxlsj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdb52ddeb3fcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd661fdeb3fcda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cdb52ddeb3fcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002da21adeb3fcda01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000041911deb3fcda01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000001dc34deb3fcda01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2544	gyznnbxlsj.exe
2544	gyznnbxlsj.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	2256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2256	SearchIndexer.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 2344	4028	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe	86
PID 4028 wrote to memory of 2344	4028	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe	86
PID 4028 wrote to memory of 2344	4028	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe	86
PID 4028 wrote to memory of 2544	4028	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe	87
PID 4028 wrote to memory of 2544	4028	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe	87
PID 4028 wrote to memory of 2544	4028	39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe	87
PID 2256 wrote to memory of 2476	2256	SearchIndexer.exe	90
PID 2256 wrote to memory of 2476	2256	SearchIndexer.exe	90
PID 2256 wrote to memory of 3676	2256	SearchIndexer.exe	91
PID 2256 wrote to memory of 3676	2256	SearchIndexer.exe	91
PID 2344 wrote to memory of 3152	2344	viqdhzdkrg.exe	92
PID 2344 wrote to memory of 3152	2344	viqdhzdkrg.exe	92
PID 2344 wrote to memory of 3152	2344	viqdhzdkrg.exe	92
PID 2544 wrote to memory of 4728	2544	gyznnbxlsj.exe	100
PID 2544 wrote to memory of 4728	2544	gyznnbxlsj.exe	100
PID 4728 wrote to memory of 4384	4728	cmd.exe	102
PID 4728 wrote to memory of 4384	4728	cmd.exe	102
PID 2544 wrote to memory of 816	2544	gyznnbxlsj.exe	103
PID 2544 wrote to memory of 816	2544	gyznnbxlsj.exe	103
PID 2544 wrote to memory of 3328	2544	gyznnbxlsj.exe	104
PID 2544 wrote to memory of 3328	2544	gyznnbxlsj.exe	104
PID 2544 wrote to memory of 3328	2544	gyznnbxlsj.exe	104

C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
"C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\viqdhzdkrg.exe
  "C:\Users\Admin\AppData\Local\Temp\viqdhzdkrg.exe" "C:\Users\Admin\AppData\Local\Temp\exmbkuavuc.exe" "C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe
    "C:\Users\Admin\AppData\Local\Temp\39a6f19fe835ddba6e650e13d2579f102574a984796094fab0d9ab7e12f031d8.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3152
- C:\Users\Admin\AppData\Local\Temp\gyznnbxlsj.exe
  C:\Users\Admin\AppData\Local\Temp\gyznnbxlsj.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Windows\System32\cmd.exe
    /c sc config msdtc obj= LocalSystem
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\system32\sc.exe
      sc config msdtc obj= LocalSystem
      4⤵
      Launches sc.exe
      PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Q7xm88zW.bat"
    3⤵
    PID:816
- - C:\Windows\System32\bindsvc.exe
    "C:\Windows\System32\bindsvc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3328

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2476
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:3676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Q7xm88zW.bat

Filesize
196B

MD5
762236efa938f5bba17503da5850b196

SHA1
f943415a336eac937a4f3665af471a6cd04ecc90

SHA256
d3afa5e8e603756b8a3f4e75d8a877feac001aeef1db2461ee2bcbeae72f76be

SHA512
25000d74a89cc652a4158aa6da91476aaeff3746f79f7d56f07ba2a634d31aab8c609dff2447b3248450b01ef4afc6c55bda4935141dae8dba967e1ac787b329

Download Submit
C:\Users\Admin\AppData\Local\Temp\exmbkuavuc.exe

Filesize
209KB

MD5
8d98511924d571c2b0e11d765b857a8a

SHA1
b9ce4bacd3e7e644626fae63f746d4466dba737e

SHA256
666902c802f71eafbbb130664af70cea1d0cae2798b5be979b29ae9fc43feb7e

SHA512
925d53bb92ae82b83456d5728e58f608576ba633ce08ef440b4bd4fb04f4db5cf6a171548ff37feca3dc3f89838b9852d4ed74e05f4e07179751f3630ca9ad04

Download Submit
C:\Users\Admin\AppData\Local\Temp\gyznnbxlsj.exe

Filesize
580KB

MD5
2c2029588ad8b86759c17b7ae885ee03

SHA1
91653b5344d4c210201218e2f215dd5228d76799

SHA256
3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290

SHA512
88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f

Download Submit
C:\Users\Admin\AppData\Local\Temp\viqdhzdkrg.exe

Filesize
51KB

MD5
e48b89715bf5e4c55eb5a1fed67865d9

SHA1
89a287da39e14b02cdc284eb287549462346d724

SHA256
c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e

SHA512
4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c

Download Submit
C:\Windows\System32\bindsvc.exe

Filesize
291KB

MD5
7c5b397fb54d5aa06bd2a6fb99c62fee

SHA1
a9e0bf7bbabf6ab9e294156985537ae972ebd743

SHA256
d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee

SHA512
daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c

Download Submit
memory/2256-21-0x000001B9B4430000-0x000001B9B4440000-memory.dmp

Filesize
64KB

Download
memory/2256-37-0x000001B9B4530000-0x000001B9B4540000-memory.dmp

Filesize
64KB

Download
memory/2256-53-0x000001B9B8A20000-0x000001B9B8A28000-memory.dmp

Filesize
32KB

Download
memory/2256-67-0x000001B9B9C90000-0x000001B9B9C98000-memory.dmp

Filesize
32KB

Download
memory/2544-15-0x0000000000320000-0x000000000049A000-memory.dmp

Filesize
1.5MB

Download
memory/2544-241-0x0000000000320000-0x000000000049A000-memory.dmp

Filesize
1.5MB

Download
memory/2544-232-0x0000000000320000-0x000000000049A000-memory.dmp

Filesize
1.5MB

Download
memory/3676-83-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-88-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-75-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-76-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-79-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-80-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-81-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-84-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-73-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-82-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-78-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-77-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-85-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-86-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-87-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-72-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-90-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-89-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-91-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-93-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-94-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-92-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-96-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-98-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-97-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-95-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-74-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-71-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-70-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download
memory/3676-69-0x000001A1AE490000-0x000001A1AE4A0000-memory.dmp

Filesize
64KB

Download