1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Size

78KB
MD5

861c41d2f482a205e06eadbbf006108f
SHA1

21998879e898286bfd8a76552fd6c560af5d0ae4
SHA256

1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2
SHA512

5343c56158aa3e14096af27f634c9ab27ed57101fbadb9c901807eec05ffb63fbff47458326ccf8eb7043fd9f0c23e33406ceded3ab5849d71bee8bb110dc9e1
SSDEEP

1536:KRvgP0t0D48ROEMr8wymiVBN+zL20gJi1ie:QgP0O7cEB2iVBgzL20WKt

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjdkjpkb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbgfkje.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkjnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffbdadk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckhdggom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkjnb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjakccop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgfkmgnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmbgfkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnimiblo.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagienkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caifjn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmhdpnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfkloq32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnmfdb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calcpm32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfkloq32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caifjn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckhdggom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cileqlmg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cileqlmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjakccop.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjdkjpkb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmhdpnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcjcme32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnimiblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cagienkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnmfdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmbcen32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bffbdadk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjcme32.exe

Executes dropped EXE 18 IoCs

pid	Process
580	Bffbdadk.exe
2472	Bcjcme32.exe
2296	Bjdkjpkb.exe
2880	Bmbgfkje.exe
2280	Cfkloq32.exe
2740	Ckhdggom.exe
2636	Cfmhdpnc.exe
1656	Cileqlmg.exe
2948	Cnimiblo.exe
2676	Cagienkb.exe
1140	Cnkjnb32.exe
1972	Caifjn32.exe
1704	Cjakccop.exe
2268	Cnmfdb32.exe
1076	Calcpm32.exe
1916	Cgfkmgnj.exe
1940	Dmbcen32.exe
984	Dpapaj32.exe

Loads dropped DLL 39 IoCs

pid	Process
1708	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
1708	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
580	Bffbdadk.exe
580	Bffbdadk.exe
2472	Bcjcme32.exe
2472	Bcjcme32.exe
2296	Bjdkjpkb.exe
2296	Bjdkjpkb.exe
2880	Bmbgfkje.exe
2880	Bmbgfkje.exe
2280	Cfkloq32.exe
2280	Cfkloq32.exe
2740	Ckhdggom.exe
2740	Ckhdggom.exe
2636	Cfmhdpnc.exe
2636	Cfmhdpnc.exe
1656	Cileqlmg.exe
1656	Cileqlmg.exe
2948	Cnimiblo.exe
2948	Cnimiblo.exe
2676	Cagienkb.exe
2676	Cagienkb.exe
1140	Cnkjnb32.exe
1140	Cnkjnb32.exe
1972	Caifjn32.exe
1972	Caifjn32.exe
1704	Cjakccop.exe
1704	Cjakccop.exe
2268	Cnmfdb32.exe
2268	Cnmfdb32.exe
1076	Calcpm32.exe
1076	Calcpm32.exe
1916	Cgfkmgnj.exe
1916	Cgfkmgnj.exe
1940	Dmbcen32.exe
1940	Dmbcen32.exe
1432	WerFault.exe
1432	WerFault.exe
1432	WerFault.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ckhdggom.exe	Cfkloq32.exe
File created	C:\Windows\SysWOW64\Hbcfdk32.dll	Cnimiblo.exe
File opened for modification	C:\Windows\SysWOW64\ÿs.e¢e	Dpapaj32.exe
File created	C:\Windows\SysWOW64\Bcjcme32.exe	Bffbdadk.exe
File opened for modification	C:\Windows\SysWOW64\Ckhdggom.exe	Cfkloq32.exe
File opened for modification	C:\Windows\SysWOW64\Cnimiblo.exe	Cileqlmg.exe
File created	C:\Windows\SysWOW64\Pobghn32.dll	Cileqlmg.exe
File opened for modification	C:\Windows\SysWOW64\Cfmhdpnc.exe	Ckhdggom.exe
File opened for modification	C:\Windows\SysWOW64\Cileqlmg.exe	Cfmhdpnc.exe
File created	C:\Windows\SysWOW64\Cagienkb.exe	Cnimiblo.exe
File created	C:\Windows\SysWOW64\Pdkefp32.dll	Dmbcen32.exe
File opened for modification	C:\Windows\SysWOW64\Bmbgfkje.exe	Bjdkjpkb.exe
File opened for modification	C:\Windows\SysWOW64\Cfkloq32.exe	Bmbgfkje.exe
File created	C:\Windows\SysWOW64\Dpapaj32.exe	Dmbcen32.exe
File created	C:\Windows\SysWOW64\Ofaejacl.dll	Cnmfdb32.exe
File created	C:\Windows\SysWOW64\Cfkloq32.exe	Bmbgfkje.exe
File created	C:\Windows\SysWOW64\Cileqlmg.exe	Cfmhdpnc.exe
File created	C:\Windows\SysWOW64\Liempneg.dll	Cagienkb.exe
File created	C:\Windows\SysWOW64\Fikbiheg.dll	Cgfkmgnj.exe
File created	C:\Windows\SysWOW64\Cjakccop.exe	Caifjn32.exe
File created	C:\Windows\SysWOW64\Calcpm32.exe	Cnmfdb32.exe
File created	C:\Windows\SysWOW64\Cnkjnb32.exe	Cagienkb.exe
File created	C:\Windows\SysWOW64\Niebgj32.dll	Cjakccop.exe
File opened for modification	C:\Windows\SysWOW64\Cgfkmgnj.exe	Calcpm32.exe
File created	C:\Windows\SysWOW64\Alecllfh.dll	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
File opened for modification	C:\Windows\SysWOW64\Cagienkb.exe	Cnimiblo.exe
File created	C:\Windows\SysWOW64\Gpajfg32.dll	Caifjn32.exe
File created	C:\Windows\SysWOW64\Lbmnig32.dll	Bcjcme32.exe
File created	C:\Windows\SysWOW64\Lbhnia32.dll	Bjdkjpkb.exe
File opened for modification	C:\Windows\SysWOW64\Cnkjnb32.exe	Cagienkb.exe
File created	C:\Windows\SysWOW64\Bjdkjpkb.exe	Bcjcme32.exe
File created	C:\Windows\SysWOW64\Cfmhdpnc.exe	Ckhdggom.exe
File created	C:\Windows\SysWOW64\Cnimiblo.exe	Cileqlmg.exe
File opened for modification	C:\Windows\SysWOW64\Cjakccop.exe	Caifjn32.exe
File opened for modification	C:\Windows\SysWOW64\Dpapaj32.exe	Dmbcen32.exe
File created	C:\Windows\SysWOW64\ÿs.e¢e	Dpapaj32.exe
File created	C:\Windows\SysWOW64\Ajaclncd.dll	Cfkloq32.exe
File created	C:\Windows\SysWOW64\Qgejemnf.dll	Ckhdggom.exe
File created	C:\Windows\SysWOW64\Cmbfdl32.dll	Cfmhdpnc.exe
File created	C:\Windows\SysWOW64\Caifjn32.exe	Cnkjnb32.exe
File created	C:\Windows\SysWOW64\Cnmfdb32.exe	Cjakccop.exe
File created	C:\Windows\SysWOW64\Cpmahlfd.dll	Calcpm32.exe
File created	C:\Windows\SysWOW64\Onaiomjo.dll	Cnkjnb32.exe
File created	C:\Windows\SysWOW64\Cgfkmgnj.exe	Calcpm32.exe
File created	C:\Windows\SysWOW64\Bffbdadk.exe	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
File created	C:\Windows\SysWOW64\Hiablm32.dll	Bffbdadk.exe
File opened for modification	C:\Windows\SysWOW64\Bjdkjpkb.exe	Bcjcme32.exe
File opened for modification	C:\Windows\SysWOW64\Cnmfdb32.exe	Cjakccop.exe
File created	C:\Windows\SysWOW64\Dmbcen32.exe	Cgfkmgnj.exe
File opened for modification	C:\Windows\SysWOW64\Dmbcen32.exe	Cgfkmgnj.exe
File opened for modification	C:\Windows\SysWOW64\Bcjcme32.exe	Bffbdadk.exe
File created	C:\Windows\SysWOW64\Bmbgfkje.exe	Bjdkjpkb.exe
File opened for modification	C:\Windows\SysWOW64\Bffbdadk.exe	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
File created	C:\Windows\SysWOW64\Oghnkh32.dll	Bmbgfkje.exe
File opened for modification	C:\Windows\SysWOW64\Caifjn32.exe	Cnkjnb32.exe
File opened for modification	C:\Windows\SysWOW64\Calcpm32.exe	Cnmfdb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1432	984	WerFault.exe	48

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfkloq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjakccop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnmfdb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjcme32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbgfkje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cileqlmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cagienkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caifjn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmbcen32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bffbdadk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjdkjpkb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfmhdpnc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnimiblo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkjnb32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dpapaj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ckhdggom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Calcpm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cgfkmgnj.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbmnig32.dll"	Bcjcme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjdkjpkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgejemnf.dll"	Ckhdggom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onaiomjo.dll"	Cnkjnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Niebgj32.dll"	Cjakccop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpmahlfd.dll"	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckhdggom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiablm32.dll"	Bffbdadk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbgfkje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cileqlmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cagienkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alecllfh.dll"	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjdkjpkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmbgfkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bffbdadk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnmfdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oghnkh32.dll"	Bmbgfkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcfdk32.dll"	Cnimiblo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cagienkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcjcme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pobghn32.dll"	Cileqlmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnmfdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckhdggom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfmhdpnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjakccop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fikbiheg.dll"	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnkjnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bffbdadk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cileqlmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liempneg.dll"	Cagienkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdkefp32.dll"	Dmbcen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfkloq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Calcpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmbcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfkloq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnimiblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnimiblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofaejacl.dll"	Cnmfdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajaclncd.dll"	Cfkloq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmbfdl32.dll"	Cfmhdpnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfmhdpnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnkjnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpajfg32.dll"	Caifjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgfkmgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcjcme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbhnia32.dll"	Bjdkjpkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caifjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjakccop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Caifjn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 580	1708	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe	31
PID 1708 wrote to memory of 580	1708	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe	31
PID 1708 wrote to memory of 580	1708	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe	31
PID 1708 wrote to memory of 580	1708	1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe	31
PID 580 wrote to memory of 2472	580	Bffbdadk.exe	32
PID 580 wrote to memory of 2472	580	Bffbdadk.exe	32
PID 580 wrote to memory of 2472	580	Bffbdadk.exe	32
PID 580 wrote to memory of 2472	580	Bffbdadk.exe	32
PID 2472 wrote to memory of 2296	2472	Bcjcme32.exe	33
PID 2472 wrote to memory of 2296	2472	Bcjcme32.exe	33
PID 2472 wrote to memory of 2296	2472	Bcjcme32.exe	33
PID 2472 wrote to memory of 2296	2472	Bcjcme32.exe	33
PID 2296 wrote to memory of 2880	2296	Bjdkjpkb.exe	34
PID 2296 wrote to memory of 2880	2296	Bjdkjpkb.exe	34
PID 2296 wrote to memory of 2880	2296	Bjdkjpkb.exe	34
PID 2296 wrote to memory of 2880	2296	Bjdkjpkb.exe	34
PID 2880 wrote to memory of 2280	2880	Bmbgfkje.exe	35
PID 2880 wrote to memory of 2280	2880	Bmbgfkje.exe	35
PID 2880 wrote to memory of 2280	2880	Bmbgfkje.exe	35
PID 2880 wrote to memory of 2280	2880	Bmbgfkje.exe	35
PID 2280 wrote to memory of 2740	2280	Cfkloq32.exe	36
PID 2280 wrote to memory of 2740	2280	Cfkloq32.exe	36
PID 2280 wrote to memory of 2740	2280	Cfkloq32.exe	36
PID 2280 wrote to memory of 2740	2280	Cfkloq32.exe	36
PID 2740 wrote to memory of 2636	2740	Ckhdggom.exe	37
PID 2740 wrote to memory of 2636	2740	Ckhdggom.exe	37
PID 2740 wrote to memory of 2636	2740	Ckhdggom.exe	37
PID 2740 wrote to memory of 2636	2740	Ckhdggom.exe	37
PID 2636 wrote to memory of 1656	2636	Cfmhdpnc.exe	38
PID 2636 wrote to memory of 1656	2636	Cfmhdpnc.exe	38
PID 2636 wrote to memory of 1656	2636	Cfmhdpnc.exe	38
PID 2636 wrote to memory of 1656	2636	Cfmhdpnc.exe	38
PID 1656 wrote to memory of 2948	1656	Cileqlmg.exe	39
PID 1656 wrote to memory of 2948	1656	Cileqlmg.exe	39
PID 1656 wrote to memory of 2948	1656	Cileqlmg.exe	39
PID 1656 wrote to memory of 2948	1656	Cileqlmg.exe	39
PID 2948 wrote to memory of 2676	2948	Cnimiblo.exe	40
PID 2948 wrote to memory of 2676	2948	Cnimiblo.exe	40
PID 2948 wrote to memory of 2676	2948	Cnimiblo.exe	40
PID 2948 wrote to memory of 2676	2948	Cnimiblo.exe	40
PID 2676 wrote to memory of 1140	2676	Cagienkb.exe	41
PID 2676 wrote to memory of 1140	2676	Cagienkb.exe	41
PID 2676 wrote to memory of 1140	2676	Cagienkb.exe	41
PID 2676 wrote to memory of 1140	2676	Cagienkb.exe	41
PID 1140 wrote to memory of 1972	1140	Cnkjnb32.exe	42
PID 1140 wrote to memory of 1972	1140	Cnkjnb32.exe	42
PID 1140 wrote to memory of 1972	1140	Cnkjnb32.exe	42
PID 1140 wrote to memory of 1972	1140	Cnkjnb32.exe	42
PID 1972 wrote to memory of 1704	1972	Caifjn32.exe	43
PID 1972 wrote to memory of 1704	1972	Caifjn32.exe	43
PID 1972 wrote to memory of 1704	1972	Caifjn32.exe	43
PID 1972 wrote to memory of 1704	1972	Caifjn32.exe	43
PID 1704 wrote to memory of 2268	1704	Cjakccop.exe	44
PID 1704 wrote to memory of 2268	1704	Cjakccop.exe	44
PID 1704 wrote to memory of 2268	1704	Cjakccop.exe	44
PID 1704 wrote to memory of 2268	1704	Cjakccop.exe	44
PID 2268 wrote to memory of 1076	2268	Cnmfdb32.exe	45
PID 2268 wrote to memory of 1076	2268	Cnmfdb32.exe	45
PID 2268 wrote to memory of 1076	2268	Cnmfdb32.exe	45
PID 2268 wrote to memory of 1076	2268	Cnmfdb32.exe	45
PID 1076 wrote to memory of 1916	1076	Calcpm32.exe	46
PID 1076 wrote to memory of 1916	1076	Calcpm32.exe	46
PID 1076 wrote to memory of 1916	1076	Calcpm32.exe	46
PID 1076 wrote to memory of 1916	1076	Calcpm32.exe	46

C:\Users\Admin\AppData\Local\Temp\1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe
"C:\Users\Admin\AppData\Local\Temp\1377aaa72e78479a43e388d071480bf538b6a6574374e2a1529b9782d2974ca2.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\Bffbdadk.exe
  C:\Windows\system32\Bffbdadk.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\SysWOW64\Bcjcme32.exe
    C:\Windows\system32\Bcjcme32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\SysWOW64\Bjdkjpkb.exe
      C:\Windows\system32\Bjdkjpkb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\SysWOW64\Bmbgfkje.exe
        
        C:\Windows\system32\Bmbgfkje.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2880
      - C:\Windows\SysWOW64\Cfkloq32.exe
        
        C:\Windows\system32\Cfkloq32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Ckhdggom.exe
        
        C:\Windows\system32\Ckhdggom.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\SysWOW64\Cfmhdpnc.exe
        
        C:\Windows\system32\Cfmhdpnc.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Cileqlmg.exe
        
        C:\Windows\system32\Cileqlmg.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Cnimiblo.exe
        
        C:\Windows\system32\Cnimiblo.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Cagienkb.exe
        
        C:\Windows\system32\Cagienkb.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Cnkjnb32.exe
        
        C:\Windows\system32\Cnkjnb32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\SysWOW64\Caifjn32.exe
        
        C:\Windows\system32\Caifjn32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Cjakccop.exe
        
        C:\Windows\system32\Cjakccop.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Cnmfdb32.exe
        
        C:\Windows\system32\Cnmfdb32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\Calcpm32.exe
        
        C:\Windows\system32\Calcpm32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1076
        
        C:\Windows\SysWOW64\Cgfkmgnj.exe
        
        C:\Windows\system32\Cgfkmgnj.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1916
        
        C:\Windows\SysWOW64\Dmbcen32.exe
        
        C:\Windows\system32\Dmbcen32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Dpapaj32.exe
        
        C:\Windows\system32\Dpapaj32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 144
        20⤵
        Loads dropped DLL
        Program crash
        
        PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bcjcme32.exe

Filesize
78KB

MD5
42b742386746c2d78f147989dc3bb5b4

SHA1
08013215dbddd4a13e9591b88aeca5f83427905d

SHA256
5ccce211b8f51aa2689acf59d97ede7a2337bc77315db10214971a2276be08e3

SHA512
7381f7f23798515acba7fefa9e7e9e7fb3eef4db79ec5b9a9c0de74351fe84c10ead39dd1daf5e8968cf2252e70ee0adc4cab14ded59a05a2c3e919292aa6c62

Download Submit
C:\Windows\SysWOW64\Bffbdadk.exe

Filesize
78KB

MD5
bf30f963ffeb321d5d32d1762906caa8

SHA1
c0386bb340c12eba36efb052b64e8060d74b7799

SHA256
4b1037224b53e02c14ef5a5d41f18166abb0f878b2b1ca8a5e9c86179e1dcf03

SHA512
61a6026a7e73bf4999e17f86474227b9842514893412a2349358a52eae868739d65388a8eccb04ae4bd420fa889af1593f6cc1d0273a630bab0e5b9b17bea4f4

Download Submit
C:\Windows\SysWOW64\Cagienkb.exe

Filesize
78KB

MD5
23515c8f147f71e7afc8526154a55ea6

SHA1
3dec4f0f59a7b9d1cc0149ef2cdad844dbc02cf3

SHA256
21129dc840aee8bb29eaa2149688a6ba0189b44d8c53400bbd20e5fde7b9c2f1

SHA512
a9a2dde09ed46bde319439652a5fd0b8a850d14753cf9239ec5c1d3e011fc5de5026e1d00453d5aeedca6ec963768704894fd2253f01305d1c9b115da39e1174

Download Submit
C:\Windows\SysWOW64\Caifjn32.exe

Filesize
78KB

MD5
a69adfff4f7d0a53985d98dbe1be11cd

SHA1
56b44c63bc867b530c0195228f6777165bb268c0

SHA256
f78cef48250f80e287fd684ddaab5a7c07ee65cd11fd2e1492dfe85ba2df98d0

SHA512
e8479cf2d962131bd106c7fa8948c4f1b541cb2379c1d8923d633ab828a09afa8a6ece04d8298a7957244ad08c098c61da622c7d304d40b7338d4bb3c0390275

Download Submit
C:\Windows\SysWOW64\Cgfkmgnj.exe

Filesize
78KB

MD5
7fc3a539f00d5c532fb460e528ef8109

SHA1
57cfb7bb3b3ebf5cb901f2018d307ce92f19a3e6

SHA256
b8dd3b445b654c94807af26213d845d28df2e3399ee936586d6813a921808b4d

SHA512
f8d3d6ee0c26dc2139451105fa10264f54e17befe1a60a8bea4cc3cfaaabe90d7e3ecf7f4a1e7255ddfd07c94a3a9199de455d46521af40543f3830847c9951d

Download Submit
C:\Windows\SysWOW64\Ckhdggom.exe

Filesize
78KB

MD5
40491825105420273adc8d482990a2ba

SHA1
851d1aa5b78ab0f188b6298a80fcfcbd7152d73c

SHA256
3f3032ec6a5cd52c1fa456e905995950c851a912c8354261382f4c0be6d50b47

SHA512
4a068e9f918af3d6ce1def72ad0b6e2f9ca9a85cc7e42d379bf9681ef8f6f2173d1d8118a588b077c2e07262a9ca8f33a05fd6557bbed38c734b04541266ae6c

Download Submit
C:\Windows\SysWOW64\Cnmfdb32.exe

Filesize
78KB

MD5
903b8d16ccdd0060395a9f5619e63c8c

SHA1
4ea75cd57a107794efe6d990369f9b06fa90e545

SHA256
4bd3cf4aeb745bc61bdcc5c807b7b3035a41f231fa623f3c5fd367f25d20ac71

SHA512
853eb454a26d3afcbfb6b945bed7c398573971dbd9ceacc8cda90dad1886fe0696f6355099e8ed73a9507e0888bd87997b074933de1adfb195c8d31ee8b51c83

Download Submit
C:\Windows\SysWOW64\Dmbcen32.exe

Filesize
78KB

MD5
854d6cf582cddd2044ff5d4745e75d2b

SHA1
cadefa0bbd7c5728221d2e5239c25bfead948b4b

SHA256
3e501f4689f484030b3e96bd3631989e4e5e3fa7853ce2da164cb1282c59e245

SHA512
e29356a4881dcc82bdb7e012ca46d22f51be1279cb5f712d0e763ffe40ed47142f7fa6921a9680b7e4c6936681ab92158b3e2399774bbb14affdb5ab48cbad8d

Download Submit
C:\Windows\SysWOW64\Dpapaj32.exe

Filesize
78KB

MD5
d16f09fcbb66c43dabc4a86365d227d7

SHA1
e2dbf6a7c89a6e05702d6697c999f0734be01a33

SHA256
1aeb4927ed876ff3071c0711c72792d146fc92ba9162d9c13cec9bf7227acce5

SHA512
f020619c9acabbca00791d6aec9d9dbbd451e256aa1c3186617361a3184047f606d3e5c25de53833df6bcebb47241fcc18de1f630feaa99454ca71238fe72c60

Download Submit
\Windows\SysWOW64\Bjdkjpkb.exe

Filesize
78KB

MD5
1b7e0f01e28cfc9d3b20936cb066d509

SHA1
6d880a8352fe6e9adaebb87546cdd1a65ce10042

SHA256
b6ba43f0d4515f4c0304c1c70c404cc9773efef73456c823645917d138291fdd

SHA512
332536dda4addca9459671f03d11587c73793830d4dee34630e2b40a8b7ae4892cfd281809f6a13a49cbc51e3165a72d546b13e71c454777a80c70b8c9a4a999

Download Submit
\Windows\SysWOW64\Bmbgfkje.exe

Filesize
78KB

MD5
415476c0fc825acba90e4b2e505832b6

SHA1
6a669a9852a4db0f8f1f30b9074dcae113c81c4e

SHA256
da0b3416d9fb0a189a4824f8066ead46ab46b83f85e53f99154b0a9f19d44cd1

SHA512
a11cfb53d47361bc627e6b82dd8113fddb3d736b804a0e0cdcee2016e50a9788cd9f04ee957de5a326f737eb723aad134805115e95cdcf14893b84885f8a593c

Download Submit
\Windows\SysWOW64\Calcpm32.exe

Filesize
78KB

MD5
5415234187ac980374fb185c08991460

SHA1
b6cec5368443ca2b7c6b7c6bc57210a64e45879f

SHA256
9b16ef573f606ce182efd33b56e39561e7a295d4246bebbf1d28462c77abee04

SHA512
9e735e4c025a29ce756e0ad13d0b5bd9863230a7ff17feb1ca0150304a4f27a47e2c7ddc01e8741e5c214bcd061b95800d54a42ba4a2f11b0941ba85377eda93

Download Submit
\Windows\SysWOW64\Cfkloq32.exe

Filesize
78KB

MD5
8588b0b1dc72036028bdbf65137cdcbd

SHA1
0e9ac881867f2bf66cf90c55d1d1283cf9842a93

SHA256
5855eaae19bfe0348a1480db77a53225969d1e2b44a4cb73c7da1f022c434e8f

SHA512
add84e9665bfa9ee84316922b732d88d71f7d1a56e36ef1a15e80f0ee6675ca2186aaa9bad1bc938321c0c771035b26d9cf92806cffd354be45db8bc6e47dc4f

Download Submit
\Windows\SysWOW64\Cfmhdpnc.exe

Filesize
78KB

MD5
09dfc3953e76aac75ca87b84c8076454

SHA1
a9749855b534badaefc414ea43a0bae8ab54c621

SHA256
a8163e930d6fecb31ea752e48cdb704f043d795c1c3534c2c17ff4d151516e70

SHA512
05e2c75a342e915c6ad9358206de0810bb369d8122f8207b6c14861476184b33fcc4cb59299a2bc90f0bd0ceec9a35018bbfc4b9e2e247852b9f559074133242

Download Submit
\Windows\SysWOW64\Cileqlmg.exe

Filesize
78KB

MD5
a3f2a1f18d57e1c8eeb4ea5439b47b7b

SHA1
99107d1c5cc9f61a64c5978af7ee8d5db063ea1f

SHA256
69db1904f69f51b9cc1037bdf85df849c3c937b2af6ab598647bbe23aca01902

SHA512
76785c8d78feb2d71b2349e9157c8cd45cabc56a22a1676d07d6bf386fd00c3db880656eb53e57093b6169adcc0edd9c6c8823bcf23d5171d2ce4f495ff4af8c

Download Submit
\Windows\SysWOW64\Cjakccop.exe

Filesize
78KB

MD5
34901e11f71e2b9b290306a1296a113f

SHA1
7ddfd99dde3069c77b5fe4d712b5f1f8e1dc6370

SHA256
d44c317603432d4916949297ad716bf43aeea71960e580e26e112b2ca679cbb7

SHA512
e8d89cdfbd644623a07ac502e87bd2f447dd7de7011a6f4d8cf11a54118a6be1d1784bd08133c088d036fdc0ce87d3fb760c25706aca3f8cf8fc43f5b1c66714

Download Submit
\Windows\SysWOW64\Cnimiblo.exe

Filesize
78KB

MD5
637bc806221e45e2f79ae471386be8e2

SHA1
d3859c363b056965f850d04dbcae93ea42a5c36e

SHA256
d20f7b15d0f589736ebef6a0c877168d6b79371b11e1cfe9ccad65d59ad0537f

SHA512
70c5770279e15dda7d45bace29b439d7654819fb828ed6cca44da1f4031d12a51dda8348f845bc11680f9e23d66e8d61698682c12f2011ca8b1e57ee9fbf83fe

Download Submit
\Windows\SysWOW64\Cnkjnb32.exe

Filesize
78KB

MD5
c64dfe3dbc02c593e35e6211763e055a

SHA1
2bf8d464e23bd13018264ee3dc42803140a73c46

SHA256
c0a6ce172dfe271a36d0e61e6fb828efb535cf1ff257ccb0bde30621a7b77ce9

SHA512
e7e1be82cd4309bfc202f729ba8168593895d7a50c729f73af178e70142ebc7b6666141c6bacf0ba36a6cadd38aa777e8589b0da823c7dd8a3de9b5a74ec034a

Download Submit
memory/580-62-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/580-13-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/984-261-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1076-257-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1140-214-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1140-155-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1140-168-0x0000000001F80000-0x0000000001FC1000-memory.dmp

Filesize
260KB

Download
memory/1656-170-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1656-118-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/1656-110-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1656-184-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/1704-242-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1708-53-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1708-12-0x00000000002D0000-0x0000000000311000-memory.dmp

Filesize
260KB

Download
memory/1708-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1916-259-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/1916-238-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/1916-230-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1916-243-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/1916-258-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1940-260-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1940-250-0x00000000002E0000-0x0000000000321000-memory.dmp

Filesize
260KB

Download
memory/1972-236-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/1972-171-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1972-179-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/1972-228-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1972-185-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/2268-215-0x0000000000260000-0x00000000002A1000-memory.dmp

Filesize
260KB

Download
memory/2268-209-0x0000000000260000-0x00000000002A1000-memory.dmp

Filesize
260KB

Download
memory/2268-201-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2268-254-0x0000000000260000-0x00000000002A1000-memory.dmp

Filesize
260KB

Download
memory/2268-244-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2280-69-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2280-123-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2280-139-0x0000000000260000-0x00000000002A1000-memory.dmp

Filesize
260KB

Download
memory/2296-45-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2472-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2472-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2472-34-0x0000000000350000-0x0000000000391000-memory.dmp

Filesize
260KB

Download
memory/2636-163-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-140-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-149-0x0000000000300000-0x0000000000341000-memory.dmp

Filesize
260KB

Download
memory/2740-91-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/2740-83-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2740-147-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2880-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2880-67-0x0000000000250000-0x0000000000291000-memory.dmp

Filesize
260KB

Download
memory/2880-54-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2948-138-0x0000000000450000-0x0000000000491000-memory.dmp

Filesize
260KB

Download
memory/2948-187-0x0000000000450000-0x0000000000491000-memory.dmp

Filesize
260KB

Download
memory/2948-137-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads