Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/11/2024, 04:27
Behavioral task
behavioral1
Sample
b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe
Resource
win7-20241010-en
windows7-x64
26 signatures
150 seconds
General
- Target b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe
- Size 255KB
- Sample241118-e3g8tayfpr
- SHA256 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c
- MD5 0c1e56be6e4358d2e0ce88794bb75973
- SHA1 55ad934f30c084db9a29f89742c48b327452304c
- SHA512 923c022a1d811ac8554ac9631f6aecb0b457569254151488bfad0b3ecf36ea2f193aa0959c0fa3fc38dad8c24e394de3443c62e65297842ca094d5959a1dd708
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJg:sxlZam+akqx6YQJXcNlEHUIQeE3mmBI7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" sxjfcgjgfb.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sxjfcgjgfb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sxjfcgjgfb.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sxjfcgjgfb.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe - Executes dropped EXE 5 IoCs
pid Process 2788 sxjfcgjgfb.exe 1484 ezztgyvhlueikkd.exe 3048 tbrcmopk.exe 2612 rfhpelrwxzuvz.exe 3088 tbrcmopk.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sxjfcgjgfb.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ulcmdmrh = "sxjfcgjgfb.exe" ezztgyvhlueikkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pjnnttge = "ezztgyvhlueikkd.exe" ezztgyvhlueikkd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "rfhpelrwxzuvz.exe" ezztgyvhlueikkd.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: tbrcmopk.exe File opened (read-only) \??\g: tbrcmopk.exe File opened (read-only) \??\e: sxjfcgjgfb.exe File opened (read-only) \??\i: sxjfcgjgfb.exe File opened (read-only) \??\w: sxjfcgjgfb.exe File opened (read-only) \??\h: tbrcmopk.exe File opened (read-only) \??\k: sxjfcgjgfb.exe File opened (read-only) \??\z: sxjfcgjgfb.exe File opened (read-only) \??\i: tbrcmopk.exe File opened (read-only) \??\x: tbrcmopk.exe File opened (read-only) \??\v: tbrcmopk.exe File opened (read-only) \??\a: sxjfcgjgfb.exe File opened (read-only) \??\g: sxjfcgjgfb.exe File opened (read-only) \??\x: sxjfcgjgfb.exe File opened (read-only) \??\a: tbrcmopk.exe File opened (read-only) \??\l: sxjfcgjgfb.exe File opened (read-only) \??\b: tbrcmopk.exe File opened (read-only) \??\b: tbrcmopk.exe File opened (read-only) \??\n: tbrcmopk.exe File opened (read-only) \??\p: tbrcmopk.exe File opened (read-only) \??\q: tbrcmopk.exe File opened (read-only) \??\r: tbrcmopk.exe File opened (read-only) \??\j: tbrcmopk.exe File opened (read-only) \??\o: tbrcmopk.exe File opened (read-only) \??\s: tbrcmopk.exe File opened (read-only) \??\w: tbrcmopk.exe File opened (read-only) \??\b: sxjfcgjgfb.exe File opened (read-only) \??\p: sxjfcgjgfb.exe File opened (read-only) \??\e: tbrcmopk.exe File opened (read-only) \??\n: tbrcmopk.exe File opened (read-only) \??\s: tbrcmopk.exe File opened (read-only) \??\o: tbrcmopk.exe File opened (read-only) \??\q: tbrcmopk.exe File opened (read-only) \??\r: tbrcmopk.exe File opened (read-only) \??\h: sxjfcgjgfb.exe File opened (read-only) \??\j: sxjfcgjgfb.exe File opened (read-only) \??\m: sxjfcgjgfb.exe File opened (read-only) \??\q: sxjfcgjgfb.exe File opened (read-only) \??\v: sxjfcgjgfb.exe File opened (read-only) \??\h: tbrcmopk.exe File opened (read-only) \??\x: tbrcmopk.exe File opened (read-only) \??\k: tbrcmopk.exe File opened (read-only) \??\a: tbrcmopk.exe File opened (read-only) \??\l: tbrcmopk.exe File opened (read-only) \??\l: tbrcmopk.exe File opened (read-only) \??\p: tbrcmopk.exe File opened (read-only) \??\m: tbrcmopk.exe File opened (read-only) \??\y: tbrcmopk.exe File opened (read-only) \??\z: tbrcmopk.exe File opened (read-only) \??\e: tbrcmopk.exe File opened (read-only) \??\k: tbrcmopk.exe File opened (read-only) \??\u: tbrcmopk.exe File opened (read-only) \??\z: tbrcmopk.exe File opened (read-only) \??\t: tbrcmopk.exe File opened (read-only) \??\u: tbrcmopk.exe File opened (read-only) \??\y: tbrcmopk.exe File opened (read-only) \??\w: tbrcmopk.exe File opened (read-only) \??\o: sxjfcgjgfb.exe File opened (read-only) \??\u: sxjfcgjgfb.exe File opened (read-only) \??\j: tbrcmopk.exe File opened (read-only) \??\m: tbrcmopk.exe File opened (read-only) \??\i: tbrcmopk.exe File opened (read-only) \??\r: sxjfcgjgfb.exe File opened (read-only) \??\t: sxjfcgjgfb.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" sxjfcgjgfb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" sxjfcgjgfb.exe - AutoIT Executable 64 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3048-27-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-32-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1664-35-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3088-42-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-84-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-85-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3048-86-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-87-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3048-89-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-90-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3088-100-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3088-99-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-567-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-566-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3048-568-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-569-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3088-588-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-603-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3048-602-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-601-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-600-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3088-604-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-605-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3048-607-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-606-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-608-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3088-609-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-610-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-611-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-613-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3048-612-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3088-614-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-615-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-618-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3048-617-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-616-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3088-622-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3048-626-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3088-625-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-629-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-631-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-630-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-632-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-633-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-634-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-635-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-637-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-636-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-638-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-640-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-639-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-641-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-642-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-643-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-644-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-646-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-645-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-647-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1484-648-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-649-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2788-650-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2612-652-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rfhpelrwxzuvz.exe b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe tbrcmopk.exe File opened for modification C:\Windows\SysWOW64\sxjfcgjgfb.exe b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe File created C:\Windows\SysWOW64\ezztgyvhlueikkd.exe b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe File opened for modification C:\Windows\SysWOW64\ezztgyvhlueikkd.exe b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe File created C:\Windows\SysWOW64\tbrcmopk.exe b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe File created C:\Windows\SysWOW64\rfhpelrwxzuvz.exe b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe File created C:\Windows\SysWOW64\sxjfcgjgfb.exe b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe File opened for modification C:\Windows\SysWOW64\tbrcmopk.exe b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll sxjfcgjgfb.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe tbrcmopk.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe tbrcmopk.exe -
resource yara_rule behavioral2/memory/1664-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000a000000023b73-5.dat upx behavioral2/files/0x000d000000023b0d-18.dat upx behavioral2/files/0x000a000000023b74-25.dat upx behavioral2/files/0x000a000000023b75-30.dat upx behavioral2/memory/3048-27-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-32-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-23-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1664-35-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3088-42-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000b000000023b5c-70.dat upx behavioral2/files/0x000a000000023b82-76.dat upx behavioral2/memory/2788-84-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-85-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3048-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-87-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3048-89-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-90-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000b000000023b86-97.dat upx behavioral2/memory/3088-100-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3088-99-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-567-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-566-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3048-568-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-569-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3088-588-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0070000000023ba6-593.dat upx behavioral2/files/0x0070000000023ba6-598.dat upx behavioral2/memory/2612-603-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3048-602-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-601-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-600-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3088-604-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-605-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3048-607-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-606-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-608-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3088-609-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-610-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-611-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-613-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3048-612-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3088-614-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-615-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-618-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3048-617-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-616-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3088-622-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3048-626-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3088-625-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-629-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-631-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-630-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-632-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-633-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-634-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-635-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-637-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-636-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2788-638-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2612-640-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1484-639-0x0000000000400000-0x00000000004A0000-memory.dmp upx - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe tbrcmopk.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe tbrcmopk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe tbrcmopk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe tbrcmopk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe tbrcmopk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe tbrcmopk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal tbrcmopk.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe tbrcmopk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe tbrcmopk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal tbrcmopk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe tbrcmopk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal tbrcmopk.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal tbrcmopk.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe tbrcmopk.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe tbrcmopk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe tbrcmopk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe tbrcmopk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe tbrcmopk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe tbrcmopk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe tbrcmopk.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe tbrcmopk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe tbrcmopk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe tbrcmopk.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe tbrcmopk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe tbrcmopk.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe tbrcmopk.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe tbrcmopk.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe tbrcmopk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe tbrcmopk.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe tbrcmopk.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ezztgyvhlueikkd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbrcmopk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfhpelrwxzuvz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbrcmopk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sxjfcgjgfb.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACFF9BEFE67F2E2830C3A31819D3999B0FA03F14314034BE1C542EB08D5" b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB0B1284497399A53BABADD33EED7CD" b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf sxjfcgjgfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs sxjfcgjgfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32402D0B9C2383596A3F76D770552CD97DF164DB" b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F88FFF84828826A913DD72B7E97BC95E643583666426241D69E" b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193FC67B15ECDAB5B9C07FE0EDE034CC" b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe Key created \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" sxjfcgjgfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" sxjfcgjgfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" sxjfcgjgfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat sxjfcgjgfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh sxjfcgjgfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" sxjfcgjgfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" sxjfcgjgfb.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F46BB9FE6721ACD20FD0A38B7B9162" b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc sxjfcgjgfb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg sxjfcgjgfb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" sxjfcgjgfb.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4504 WINWORD.EXE 4504 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 1484 ezztgyvhlueikkd.exe 2788 sxjfcgjgfb.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3088 tbrcmopk.exe 3088 tbrcmopk.exe 3088 tbrcmopk.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 2788 sxjfcgjgfb.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 1484 ezztgyvhlueikkd.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 2612 rfhpelrwxzuvz.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3048 tbrcmopk.exe 3088 tbrcmopk.exe 3088 tbrcmopk.exe 3088 tbrcmopk.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4504 WINWORD.EXE 4504 WINWORD.EXE 4504 WINWORD.EXE 4504 WINWORD.EXE 4504 WINWORD.EXE 4504 WINWORD.EXE 4504 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2788 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 83 PID 1664 wrote to memory of 2788 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 83 PID 1664 wrote to memory of 2788 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 83 PID 1664 wrote to memory of 1484 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 84 PID 1664 wrote to memory of 1484 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 84 PID 1664 wrote to memory of 1484 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 84 PID 1664 wrote to memory of 3048 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 85 PID 1664 wrote to memory of 3048 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 85 PID 1664 wrote to memory of 3048 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 85 PID 1664 wrote to memory of 2612 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 86 PID 1664 wrote to memory of 2612 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 86 PID 1664 wrote to memory of 2612 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 86 PID 1664 wrote to memory of 4504 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 88 PID 1664 wrote to memory of 4504 1664 b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe 88 PID 2788 wrote to memory of 3088 2788 sxjfcgjgfb.exe 90 PID 2788 wrote to memory of 3088 2788 sxjfcgjgfb.exe 90 PID 2788 wrote to memory of 3088 2788 sxjfcgjgfb.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe"C:\Users\Admin\AppData\Local\Temp\b96675d20f7a56c5a0529551754ee2123bcc483c9e3d95ec62ec807ec9c2981c.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\sxjfcgjgfb.exesxjfcgjgfb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\tbrcmopk.exeC:\Windows\system32\tbrcmopk.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3088
-
-
-
C:\Windows\SysWOW64\ezztgyvhlueikkd.exeezztgyvhlueikkd.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1484
-
-
C:\Windows\SysWOW64\tbrcmopk.exetbrcmopk.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3048
-
-
C:\Windows\SysWOW64\rfhpelrwxzuvz.exerfhpelrwxzuvz.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2612
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4504
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 255KB
- SHA256 9c22a41758c01ba3f565f65c03dd981f920720833a7ab3a559eeacc395576c6b
- MD5 a8a8e08a4141a89a163dea1ba6983da3
- SHA1 78e758c146b9f0f0c891355aaaa8c603af9957a7
- SHA512 16310f89380ff67f3810750869dd60f99bf102765659290cba0546076cbff6ad493021c572c2a981f5c4438b9da6c77cf877538a5ad0ed512972b8ded857e96d
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJK:sxlZam+akqx6YQJXcNlEHUIQeE3mmBID
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 255KB
- SHA256 1f5f3d73daefc109f9dedf0770279ad1526299da8369038cefd7b4ec4c105d50
- MD5 9c967d2cc69cb4deaaf1eb919ef52a7e
- SHA1 107d2d3582411d05dc7c855c37690bece9957bdc
- SHA512 f9befc0e26278890c75d846ffb964657faaa9dae12eedf8e0041a2ceb24f6589394d97ba1762b7fca2acdafde8a37bc18deca7e398e08b09cf169eae82c78d0c
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJa:sxlZam+akqx6YQJXcNlEHUIQeE3mmBI7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TCDD3BE.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 286B
- SHA256 e916114c8cc61ae04767ca6574ffdf1da1b2cfc5763fdfbeef7c68266d55f043
- MD5 34231126460309d40377289f78b627ff
- SHA1 58ecd5b8e8ef8c9bdc972ec63d67c1bb31ed8ca6
- SHA512 d15be426e4d96d218b83c2e1176e429de3b138606163ae908d268daa09b74d8e7a543327a8389a3f1ccd60397c097e3c47a26a7136ec2f72589e5f38d9b9ae2c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 8a9c29fe403303f16caac82d9d90417c1a37db03db1291bc93ae99272b5367a0
- MD5 2cbd0e29caa88b5a5e239952c291e0f4
- SHA1 d67557a884ad6d257077e6c8e51b700ef36f4b15
- SHA512 debf2c28ebf3e222b52e9a234351338019e785d7ff9cca30444c1d5f36e3c94c7e306bf7d243b867756d3232c7662a8d1a2c47970129fb18241da34c26e6423c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 684B
- SHA256 f674d8e0ffa7ec1c74e127fd8bc44adac055ba0991889f81eb04e5745003fa0a
- MD5 508d4546e0ac9e8492a0501567afde40
- SHA1 ef05511305a76726b0a9a76b5fd7bd69c2e1fad7
- SHA512 0ab17259e76ab2b5960bfb3a020b1c073e87a12e46c0a9d761e894d7836c350300a593df1242f4b90b60236ef6ffc77135adf80ff941e086008dde263af0d0e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Documents\ResetCheckpoint.doc.exe
- Size 255KB
- SHA256 c30936ec01b0424c7092e2802deed7332f7cb2dee806b2e44632bf4f90258b5f
- MD5 99dee1d958c4840b8cb2e94dd2d3e4ed
- SHA1 f00a592eea77beb20beda6a916d2f0bc71f39517
- SHA512 a53a0af3df878fcc4c18b12571f2bc07c546cf0c5c470ff9c6780fe7e474f2060aa68cc2d702229c56cf763e3b553ea7977d41f007f3a4934aad464be3c290db
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:sxlZam+akqx6YQJXcNlEHUIQeE3mmBIw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ezztgyvhlueikkd.exe
- Size 255KB
- SHA256 a916195a73e4108faaa601c81882e534d5f98bd23beb1567a47a3ef4597a931d
- MD5 dedc7ec7cde7cc19f2059e16af1ebef3
- SHA1 c88b894deb1e2c26fb79f1b6fe399792148e3912
- SHA512 738f6acae55140bdf5b2ea624fa96d2026dd389b4813d58332863d47e35c66bb0b318752843cf3c7acecfd15f5fe1ae2555a6bb604efdf916273e20d134b181a
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ2:sxlZam+akqx6YQJXcNlEHUIQeE3mmBIv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\rfhpelrwxzuvz.exe
- Size 255KB
- SHA256 67c15415af0480690caf5e0ef523d89453bae335d73ca8ed64c83f17d619d45c
- MD5 c184a7ebac96b6f7e5c3db5ba3d2309c
- SHA1 15f0ee9708a0c9ed2a47150d019ebc8aae900416
- SHA512 b8c70b0b816ab459b7c7b0c1386a414dc6a7ece45b74d792d4f75cdcfa999ecc62f21a389217839ce47f204a1ca0706fe7c0d8c5e7d4e4496c8dd26efb394ca1
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJW:sxlZam+akqx6YQJXcNlEHUIQeE3mmBIj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sxjfcgjgfb.exe
- Size 255KB
- SHA256 6c155491f9442db725c4753edc29566faf0a88977fa21954f01b6d0d04f78632
- MD5 27089ea673b67155a1cc5b48f58b3eab
- SHA1 79b0344be6cc96355f60970587056fe1af39d1aa
- SHA512 10dc81d9b7d56bea1c5663b85173d42de3d9fb57b17f1273b82ddd60919c04293baa51f6f34a65a87aa7cb383957154d65e19c70d8db7b011aa25bd6769fbc87
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJU:sxlZam+akqx6YQJXcNlEHUIQeE3mmBIN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tbrcmopk.exe
- Size 255KB
- SHA256 be323f7855cc63d538ad327dba529595cbd692c894066839ef9dcbc426359348
- MD5 3e566095d1cbe756522517bd27bc2883
- SHA1 fac082017248e25840c49923e1712500e5b2b044
- SHA512 bd6b25a406da5f24e2359c36a2a7c1db025c69cb947dc8111b8c6d8cd6d8705e6a65cab587023748ab59f435e32d286f2f66389b097298a1e122910c67e357a5
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ8:sxlZam+akqx6YQJXcNlEHUIQeE3mmBI1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 16e8dc0721b94e3ef176349023c099a1881eb3827a531e0f601308e9599b13c5
- MD5 61afc8f4d0c1f3509a31da1ff81ecfd3
- SHA1 2f4aea242b9e52284b1930d3bd059d2af9d414e1
- SHA512 66dd23486a07ff23dd95dcda4ff0a6af4b67a73c062dcb9ab1200c0b621aba8202c36c5e053b32354383a5ee70bf8b7fce206a5d16807523a1c165b0b99424c4
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJS:sxlZam+akqx6YQJXcNlEHUIQeE3mmBIP
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 68f445d9f4e900d2dcd89df5bd700e1ee68bc6141ad2f84cf5fdd9bfb6cad5f4
- MD5 715a6e327c0c6a03b507fed8049fd504
- SHA1 bded835045bfd58c9e5835432e917d7a739f00e8
- SHA512 fddd007ce63f27362e77efa58c8b24bb24fffc9ff455ed4612d516c6f06afa92387fb595828c36b1cebc20ede66fa57bbb06cc7ecb790b6ba19139a02be2b5d3
- SSDEEP 3072:HMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ+:sxlZam+akqx6YQJXcNlEHUIQeE3mmBI9
- MD5 SHA1 SHA512 SSDEEP