Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 21:12
Static task
static1
Behavioral task
behavioral1
Sample
eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe
Resource
win7-20240903-en
General
-
Target
eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe
-
Size
512KB
-
MD5
d8f727185707eeac395c1761e2b34320
-
SHA1
a2779fe447275984460d5139b4cdbd38f69d1fe1
-
SHA256
eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734d
-
SHA512
08cb5ed658412310e7b65361d7361a057fa131ead5db7389bf581a1ae8f9ebf782c531485c7649b9a8889ab6abfa1486fe8cfe49e86ed0d9e9a1658127250a60
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" csbwwdzhup.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" csbwwdzhup.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" csbwwdzhup.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" csbwwdzhup.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe -
Executes dropped EXE 5 IoCs
pid Process 4860 csbwwdzhup.exe 2260 ygawgrrclmvdwpd.exe 4752 ojxmtmvt.exe 4528 iyhkumqxzqtkk.exe 5008 ojxmtmvt.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" csbwwdzhup.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\riztyehy = "csbwwdzhup.exe" ygawgrrclmvdwpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dohmvylp = "ygawgrrclmvdwpd.exe" ygawgrrclmvdwpd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "iyhkumqxzqtkk.exe" ygawgrrclmvdwpd.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\y: csbwwdzhup.exe File opened (read-only) \??\s: ojxmtmvt.exe File opened (read-only) \??\r: csbwwdzhup.exe File opened (read-only) \??\s: csbwwdzhup.exe File opened (read-only) \??\i: ojxmtmvt.exe File opened (read-only) \??\k: ojxmtmvt.exe File opened (read-only) \??\s: ojxmtmvt.exe File opened (read-only) \??\x: ojxmtmvt.exe File opened (read-only) \??\j: ojxmtmvt.exe File opened (read-only) \??\k: ojxmtmvt.exe File opened (read-only) \??\x: ojxmtmvt.exe File opened (read-only) \??\q: ojxmtmvt.exe File opened (read-only) \??\y: ojxmtmvt.exe File opened (read-only) \??\k: csbwwdzhup.exe File opened (read-only) \??\w: csbwwdzhup.exe File opened (read-only) \??\g: ojxmtmvt.exe File opened (read-only) \??\r: ojxmtmvt.exe File opened (read-only) \??\w: ojxmtmvt.exe File opened (read-only) \??\l: csbwwdzhup.exe File opened (read-only) \??\u: ojxmtmvt.exe File opened (read-only) \??\o: csbwwdzhup.exe File opened (read-only) \??\h: ojxmtmvt.exe File opened (read-only) \??\z: ojxmtmvt.exe File opened (read-only) \??\i: csbwwdzhup.exe File opened (read-only) \??\t: csbwwdzhup.exe File opened (read-only) \??\p: ojxmtmvt.exe File opened (read-only) \??\e: ojxmtmvt.exe File opened (read-only) \??\h: ojxmtmvt.exe File opened (read-only) \??\b: csbwwdzhup.exe File opened (read-only) \??\g: csbwwdzhup.exe File opened (read-only) \??\a: ojxmtmvt.exe File opened (read-only) \??\e: ojxmtmvt.exe File opened (read-only) \??\h: csbwwdzhup.exe File opened (read-only) \??\b: ojxmtmvt.exe File opened (read-only) \??\j: csbwwdzhup.exe File opened (read-only) \??\q: csbwwdzhup.exe File opened (read-only) \??\w: ojxmtmvt.exe File opened (read-only) \??\m: csbwwdzhup.exe File opened (read-only) \??\b: ojxmtmvt.exe File opened (read-only) \??\q: ojxmtmvt.exe File opened (read-only) \??\t: ojxmtmvt.exe File opened (read-only) \??\n: csbwwdzhup.exe File opened (read-only) \??\g: ojxmtmvt.exe File opened (read-only) \??\l: ojxmtmvt.exe File opened (read-only) \??\z: csbwwdzhup.exe File opened (read-only) \??\j: ojxmtmvt.exe File opened (read-only) \??\m: ojxmtmvt.exe File opened (read-only) \??\v: ojxmtmvt.exe File opened (read-only) \??\e: csbwwdzhup.exe File opened (read-only) \??\r: ojxmtmvt.exe File opened (read-only) \??\t: ojxmtmvt.exe File opened (read-only) \??\v: ojxmtmvt.exe File opened (read-only) \??\a: ojxmtmvt.exe File opened (read-only) \??\x: csbwwdzhup.exe File opened (read-only) \??\i: ojxmtmvt.exe File opened (read-only) \??\n: ojxmtmvt.exe File opened (read-only) \??\p: csbwwdzhup.exe File opened (read-only) \??\u: ojxmtmvt.exe File opened (read-only) \??\l: ojxmtmvt.exe File opened (read-only) \??\o: ojxmtmvt.exe File opened (read-only) \??\p: ojxmtmvt.exe File opened (read-only) \??\a: csbwwdzhup.exe File opened (read-only) \??\z: ojxmtmvt.exe File opened (read-only) \??\o: ojxmtmvt.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" csbwwdzhup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" csbwwdzhup.exe -
AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2120-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x0007000000023cab-5.dat autoit_exe behavioral2/files/0x0008000000023ca7-18.dat autoit_exe behavioral2/files/0x0007000000023cac-27.dat autoit_exe behavioral2/files/0x0007000000023cad-32.dat autoit_exe behavioral2/files/0x0008000000023c97-73.dat autoit_exe behavioral2/files/0x0019000000023ccb-219.dat autoit_exe behavioral2/files/0x0019000000023ccb-222.dat autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iyhkumqxzqtkk.exe eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll csbwwdzhup.exe File created C:\Windows\SysWOW64\csbwwdzhup.exe eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe File opened for modification C:\Windows\SysWOW64\csbwwdzhup.exe eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe File opened for modification C:\Windows\SysWOW64\ygawgrrclmvdwpd.exe eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe File created C:\Windows\SysWOW64\ojxmtmvt.exe eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe File opened for modification C:\Windows\SysWOW64\ojxmtmvt.exe eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe File created C:\Windows\SysWOW64\iyhkumqxzqtkk.exe eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ojxmtmvt.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ojxmtmvt.exe File created C:\Windows\SysWOW64\ygawgrrclmvdwpd.exe eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ojxmtmvt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ojxmtmvt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ojxmtmvt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ojxmtmvt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ojxmtmvt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ojxmtmvt.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ojxmtmvt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ojxmtmvt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ojxmtmvt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ojxmtmvt.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ojxmtmvt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ojxmtmvt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ojxmtmvt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ojxmtmvt.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ojxmtmvt.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ojxmtmvt.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ojxmtmvt.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ojxmtmvt.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ojxmtmvt.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification C:\Windows\mydoc.rtf eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ojxmtmvt.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ojxmtmvt.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ojxmtmvt.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ojxmtmvt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csbwwdzhup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ygawgrrclmvdwpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ojxmtmvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iyhkumqxzqtkk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ojxmtmvt.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC4B12044E639EF52CABAA63393D4BB" eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat csbwwdzhup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" csbwwdzhup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc csbwwdzhup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" csbwwdzhup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33402D7B9C5282586D4476D477552CD67CF465D9" eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBCFACAF917F2E7830C3A4381993992B0FA02F94215033DE2C9459908D5" eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF8FC8E4828851A903DD72A7E94BCE5E641584666436335D79F" eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf csbwwdzhup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs csbwwdzhup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" csbwwdzhup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F36BC3FF6E22DCD179D0D28A0E9063" eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1844C67E1593DAB6B9B97F92ED9237C9" eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" csbwwdzhup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg csbwwdzhup.exe Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" csbwwdzhup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh csbwwdzhup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" csbwwdzhup.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4764 WINWORD.EXE 4764 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 2260 ygawgrrclmvdwpd.exe 2260 ygawgrrclmvdwpd.exe 2260 ygawgrrclmvdwpd.exe 2260 ygawgrrclmvdwpd.exe 2260 ygawgrrclmvdwpd.exe 2260 ygawgrrclmvdwpd.exe 2260 ygawgrrclmvdwpd.exe 2260 ygawgrrclmvdwpd.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 4528 iyhkumqxzqtkk.exe 2260 ygawgrrclmvdwpd.exe 2260 ygawgrrclmvdwpd.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 2260 ygawgrrclmvdwpd.exe 4528 iyhkumqxzqtkk.exe 2260 ygawgrrclmvdwpd.exe 4528 iyhkumqxzqtkk.exe 2260 ygawgrrclmvdwpd.exe 4528 iyhkumqxzqtkk.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4752 ojxmtmvt.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 4860 csbwwdzhup.exe 2260 ygawgrrclmvdwpd.exe 4528 iyhkumqxzqtkk.exe 2260 ygawgrrclmvdwpd.exe 4528 iyhkumqxzqtkk.exe 2260 ygawgrrclmvdwpd.exe 4528 iyhkumqxzqtkk.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe 5008 ojxmtmvt.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4764 WINWORD.EXE 4764 WINWORD.EXE 4764 WINWORD.EXE 4764 WINWORD.EXE 4764 WINWORD.EXE 4764 WINWORD.EXE 4764 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2120 wrote to memory of 4860 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 84 PID 2120 wrote to memory of 4860 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 84 PID 2120 wrote to memory of 4860 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 84 PID 2120 wrote to memory of 2260 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 85 PID 2120 wrote to memory of 2260 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 85 PID 2120 wrote to memory of 2260 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 85 PID 2120 wrote to memory of 4752 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 86 PID 2120 wrote to memory of 4752 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 86 PID 2120 wrote to memory of 4752 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 86 PID 2120 wrote to memory of 4528 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 87 PID 2120 wrote to memory of 4528 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 87 PID 2120 wrote to memory of 4528 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 87 PID 4860 wrote to memory of 5008 4860 csbwwdzhup.exe 88 PID 4860 wrote to memory of 5008 4860 csbwwdzhup.exe 88 PID 4860 wrote to memory of 5008 4860 csbwwdzhup.exe 88 PID 2120 wrote to memory of 4764 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 89 PID 2120 wrote to memory of 4764 2120 eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe"C:\Users\Admin\AppData\Local\Temp\eb2087ef1f7f2ba17e2fd823fee9bd3dee7a3b91e51f3b2bd9051d7ab1f5734dN.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\csbwwdzhup.execsbwwdzhup.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\ojxmtmvt.exeC:\Windows\system32\ojxmtmvt.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5008
-
-
-
C:\Windows\SysWOW64\ygawgrrclmvdwpd.exeygawgrrclmvdwpd.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2260
-
-
C:\Windows\SysWOW64\ojxmtmvt.exeojxmtmvt.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4752
-
-
C:\Windows\SysWOW64\iyhkumqxzqtkk.exeiyhkumqxzqtkk.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4528
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4764
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD508834a6a18cd952e31a1dc54b6f8587a
SHA1ae7f5f3eebb45bcc528139df1e52cf9211a3ccb6
SHA256e3aa9568e431ade02f136eb6feb200eba7e6576873fc8755f67de708e0089b4b
SHA512a371c3005d6b3ae90ed8eefe55a38040393275468e8146471cb1c8f149f561ddf1f2c027416061aa00897c5ee7ff21f4902bf0c4e1ed05ebf71c154a26f5e3dd
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
383B
MD5db2f45dc4a86062bdd8db713dbab79c0
SHA1f5fbb0cf91b73cf92da3759426165d0d85333fdc
SHA2567a9f84e1fe76dc52b709452214076fb378f163a5bfa1d693b547a4603e4cc630
SHA5127143b38b8ef0578c50b2972e500a34df0ce5d1c4cc93165fad704042fbba04ebfba1a66aae9dca540816f7994815dc93614812f44000affa103331d345aaf83a
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize2KB
MD5e87afa616998017fdb4411c33fa32bfe
SHA19bdb3386ccb56bb674796afe05b4848a582c88fe
SHA2562c3cb30aa7ef2e49c1cf6a4962cf6a4f751f066dc862e96b91478147c0107167
SHA512ad55a80d4400aa3d02e038aa35ee641dc32d7b44240b7112ddc66af09a90ad80a80d57f086da92156955adc9a69dbb84f9915f86009836a1ddb759174d07703f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD58a91f498267df9f8312f5c4094579eca
SHA17a275190931886e903712621d6773724b3c7d9fd
SHA2569b19fee70e458a03db59b684bd10cf7af2c691e701cb240b41549f026e8655f2
SHA5128d05956fc39b08f85659c6b205c0e2cd96afb88f32b15773fac30e38b056c95ae58e58cdcde52287214926c5864c2b7d5cc2c03fbfd534a75f645fe2144e8a31
-
Filesize
512KB
MD5096ca3d99fa206df45d81c8611534dcb
SHA10f10f38fde0703d065983bb123a09e81b17074c7
SHA25660e5c8d8001a0a09468e6ffb532321372e177f8e91f0dc8af5c6e513c0195a85
SHA5124677d6a8a734a8fe84778efe760700c6b35f34b3447bc5081f3bc010c0d7bc0617d367c02d9a8deaec702a30f9c259e335a96eb8593b76e6cceacdb23bcfa998
-
Filesize
512KB
MD506f4a7119ee80cf567847676d88828a5
SHA147eb5505a05ecc8e52eb3711ec489fc5e1d82cb5
SHA2566eea5cc43217e847f0faea946cf8af66624db620f0b0a36cd079761b5a3d961b
SHA512d75eaf2494c83f60a9169c7a4fdcdda33915e4518446ae223df14b3f1b88bdccb40ccf52831ad2cfa2405f90f823347ae58d19c3c18a4654833116ab590f4444
-
Filesize
512KB
MD5beadf65cc46dc60a3bc626f978f7d891
SHA1bcd40f6d4d961334bb44052f5b01f42638a1e368
SHA256ce1870533039f3198bff8eace3a34b0831863128092aa4b550ac4251621a3f26
SHA5125d62c8f6b90da09e0e9b9089f632e3260af0a094d7d68a279e321403706134fa6fea560b9522b6f7148522a538366cd52b98f05e5c3ef3e3967d68151d414b45
-
Filesize
512KB
MD532d811243598873ea7b72837e02b112f
SHA166f667a34c0258b45f8fe56dc8f6bc49a586ff19
SHA25658632ea782f24dccaf9a8fd4734c9a9fa968c0cf5217538adfd3a9c345963bbd
SHA512be683452d94a4554e20cba79fa5238736f64001ea9cfcaf58415e6c3c527969c60a7322ecb1a903b28eac4333f78260ed49d0809a873dd85b600aa49c204551f
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5b0ecea1d79e81a6dbeed5c0255acd316
SHA15a67638e48b34049ae7b469c3c88a5424d3a7372
SHA2566c8267e0529d02e0344f7e34e2dda1577ce0b9c0a168d8fe88f328af9001ca6e
SHA512343326beaf738a6f4b63c2c37329f0770b3bdcd1c8a6f9ea298936fd3d71619e813408b881dbd2ca072119136a07b67244e5f14a8721774062e66b653e88a79a
-
Filesize
512KB
MD5258e68a9ade95f18c6680b190b60c089
SHA1f709e8823d949546bf1c335ab7bfe4fa10865674
SHA256770e4e79cb7b90402208cedf453ad8779945ba717eecf2537d894ab7847bd199
SHA51202d5023e9c00a156815bb9132382d9f9ca2b9d9abd3b10b1895f0d6a84becb2ad1c1202503a6b7f9145dc4db967b3d9da26f20233b2f3c110ae70d1793c82a3a