Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 13:59
Behavioral task
behavioral1
Sample
2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
27 signatures
150 seconds
General
- Target 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe
- Size 514KB
- Sample260417-ragg2aa17w
- SHA256 133ce56459c69089791ff32e9738e7225fde2f71d87f54f0b24390dc28e3de43
- MD5 5c81c558cf8c82dcb91c03b34abe1dc7
- SHA1 9c81829663d103b17c58b03e2d93567ac667bb88
- SHA512 a54f85bdf92704ca6f32390fbaf5d0f67eefb1e08ad601825f7ce8caece7f8bf4e17c1e4eae3fcf38117d0aed58d8b9cea5f4c20ce51883bc9edab4fd701a20b
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- TLSH T155B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 8 IoCs
resource yara_rule behavioral2/files/0x001d00000002b266-5.dat family_sohanad behavioral2/files/0x000700000000d3f6-18.dat family_sohanad behavioral2/files/0x001a00000002b36c-26.dat family_sohanad behavioral2/files/0x001900000002b36d-32.dat family_sohanad behavioral2/files/0x000200000002a193-60.dat family_sohanad behavioral2/files/0x001900000002b37c-63.dat family_sohanad behavioral2/files/0x001a00000002b3be-407.dat family_sohanad behavioral2/files/0x001a00000002b3be-418.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" gwknhzcxjw.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" gwknhzcxjw.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gwknhzcxjw.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gwknhzcxjw.exe - Executes dropped EXE 5 IoCs
pid Process 3092 gwknhzcxjw.exe 3248 aanwhwzxegvchak.exe 1676 cjlfnsve.exe 2204 bgjlwtkiflcgc.exe 1180 cjlfnsve.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" gwknhzcxjw.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wrulzkoq = "gwknhzcxjw.exe" aanwhwzxegvchak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bjrzprwb = "aanwhwzxegvchak.exe" aanwhwzxegvchak.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "bgjlwtkiflcgc.exe" aanwhwzxegvchak.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: cjlfnsve.exe File opened (read-only) \??\x: cjlfnsve.exe File opened (read-only) \??\y: cjlfnsve.exe File opened (read-only) \??\q: gwknhzcxjw.exe File opened (read-only) \??\z: cjlfnsve.exe File opened (read-only) \??\n: cjlfnsve.exe File opened (read-only) \??\p: cjlfnsve.exe File opened (read-only) \??\w: cjlfnsve.exe File opened (read-only) \??\s: gwknhzcxjw.exe File opened (read-only) \??\k: cjlfnsve.exe File opened (read-only) \??\o: cjlfnsve.exe File opened (read-only) \??\i: cjlfnsve.exe File opened (read-only) \??\w: gwknhzcxjw.exe File opened (read-only) \??\r: cjlfnsve.exe File opened (read-only) \??\v: cjlfnsve.exe File opened (read-only) \??\g: cjlfnsve.exe File opened (read-only) \??\x: gwknhzcxjw.exe File opened (read-only) \??\m: cjlfnsve.exe File opened (read-only) \??\u: cjlfnsve.exe File opened (read-only) \??\j: cjlfnsve.exe File opened (read-only) \??\l: gwknhzcxjw.exe File opened (read-only) \??\p: gwknhzcxjw.exe File opened (read-only) \??\p: cjlfnsve.exe File opened (read-only) \??\m: cjlfnsve.exe File opened (read-only) \??\t: cjlfnsve.exe File opened (read-only) \??\t: gwknhzcxjw.exe File opened (read-only) \??\t: cjlfnsve.exe File opened (read-only) \??\x: cjlfnsve.exe File opened (read-only) \??\e: gwknhzcxjw.exe File opened (read-only) \??\s: cjlfnsve.exe File opened (read-only) \??\o: gwknhzcxjw.exe File opened (read-only) \??\b: cjlfnsve.exe File opened (read-only) \??\w: cjlfnsve.exe File opened (read-only) \??\e: cjlfnsve.exe File opened (read-only) \??\v: gwknhzcxjw.exe File opened (read-only) \??\n: cjlfnsve.exe File opened (read-only) \??\r: cjlfnsve.exe File opened (read-only) \??\a: gwknhzcxjw.exe File opened (read-only) \??\r: gwknhzcxjw.exe File opened (read-only) \??\v: cjlfnsve.exe File opened (read-only) \??\z: gwknhzcxjw.exe File opened (read-only) \??\a: cjlfnsve.exe File opened (read-only) \??\g: cjlfnsve.exe File opened (read-only) \??\h: cjlfnsve.exe File opened (read-only) \??\o: cjlfnsve.exe File opened (read-only) \??\k: gwknhzcxjw.exe File opened (read-only) \??\n: gwknhzcxjw.exe File opened (read-only) \??\l: cjlfnsve.exe File opened (read-only) \??\b: gwknhzcxjw.exe File opened (read-only) \??\i: gwknhzcxjw.exe File opened (read-only) \??\m: gwknhzcxjw.exe File opened (read-only) \??\s: cjlfnsve.exe File opened (read-only) \??\y: cjlfnsve.exe File opened (read-only) \??\l: cjlfnsve.exe File opened (read-only) \??\e: cjlfnsve.exe File opened (read-only) \??\h: cjlfnsve.exe File opened (read-only) \??\k: cjlfnsve.exe File opened (read-only) \??\z: cjlfnsve.exe File opened (read-only) \??\j: cjlfnsve.exe File opened (read-only) \??\b: cjlfnsve.exe File opened (read-only) \??\u: cjlfnsve.exe File opened (read-only) \??\u: gwknhzcxjw.exe File opened (read-only) \??\y: gwknhzcxjw.exe File opened (read-only) \??\q: cjlfnsve.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" gwknhzcxjw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" gwknhzcxjw.exe - AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4260-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x001d00000002b266-5.dat autoit_exe behavioral2/files/0x000700000000d3f6-18.dat autoit_exe behavioral2/files/0x001a00000002b36c-26.dat autoit_exe behavioral2/files/0x001900000002b36d-32.dat autoit_exe behavioral2/files/0x000200000002a193-60.dat autoit_exe behavioral2/files/0x001900000002b37c-63.dat autoit_exe behavioral2/files/0x001a00000002b3be-407.dat autoit_exe behavioral2/files/0x001a00000002b3be-418.dat autoit_exe - Drops file in System32 directory 13 IoCs
description ioc Process File created C:\Windows\SysWOW64\cjlfnsve.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\cjlfnsve.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File created C:\Windows\SysWOW64\bgjlwtkiflcgc.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\bgjlwtkiflcgc.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll gwknhzcxjw.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjlfnsve.exe File created C:\Windows\SysWOW64\aanwhwzxegvchak.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\aanwhwzxegvchak.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjlfnsve.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjlfnsve.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cjlfnsve.exe File created C:\Windows\SysWOW64\gwknhzcxjw.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\gwknhzcxjw.exe 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjlfnsve.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cjlfnsve.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjlfnsve.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cjlfnsve.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjlfnsve.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjlfnsve.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cjlfnsve.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjlfnsve.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjlfnsve.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cjlfnsve.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjlfnsve.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjlfnsve.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cjlfnsve.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cjlfnsve.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe cjlfnsve.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe cjlfnsve.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe cjlfnsve.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe cjlfnsve.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe cjlfnsve.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe cjlfnsve.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_1397e172aefba0be\MsoIrmProtector.doc.exe cjlfnsve.exe File opened for modification C:\Windows\mydoc.rtf 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.22000.318_none_094337207a9adec3\MsoIrmProtector.doc.exe cjlfnsve.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gwknhzcxjw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aanwhwzxegvchak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cjlfnsve.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bgjlwtkiflcgc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cjlfnsve.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" gwknhzcxjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E88FFFB482A851D9046D6587DE5BDE4E134594B67446342D7EE" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" gwknhzcxjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" gwknhzcxjw.exe Key created \REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh gwknhzcxjw.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33442D7F9C2283516A3477A170252DD67D8465DE" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F668B7FF1821ABD17AD0A58A0F906B" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat gwknhzcxjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" gwknhzcxjw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs gwknhzcxjw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg gwknhzcxjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB4FACCF963F2E783783A4681EA3E99B08A02884215033AE1BD429A08A1" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B12047E2399D53BFB9D13393D7B8" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1839C67B14E0DBB1B9BB7FE6ECE034CB" 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" gwknhzcxjw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" gwknhzcxjw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc gwknhzcxjw.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf gwknhzcxjw.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4816 WINWORD.EXE 4816 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 1676 cjlfnsve.exe 1676 cjlfnsve.exe 1676 cjlfnsve.exe 1676 cjlfnsve.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 1676 cjlfnsve.exe 1676 cjlfnsve.exe 2204 bgjlwtkiflcgc.exe 1676 cjlfnsve.exe 1676 cjlfnsve.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 1180 cjlfnsve.exe 1180 cjlfnsve.exe 1180 cjlfnsve.exe 1180 cjlfnsve.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 1676 cjlfnsve.exe 1676 cjlfnsve.exe 1676 cjlfnsve.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 1180 cjlfnsve.exe 1180 cjlfnsve.exe 1180 cjlfnsve.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3092 gwknhzcxjw.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 3248 aanwhwzxegvchak.exe 1676 cjlfnsve.exe 1676 cjlfnsve.exe 1676 cjlfnsve.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 2204 bgjlwtkiflcgc.exe 1180 cjlfnsve.exe 1180 cjlfnsve.exe 1180 cjlfnsve.exe - Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 4816 WINWORD.EXE 4816 WINWORD.EXE 4816 WINWORD.EXE 4816 WINWORD.EXE 4816 WINWORD.EXE 4816 WINWORD.EXE 4816 WINWORD.EXE 4816 WINWORD.EXE 4816 WINWORD.EXE 4816 WINWORD.EXE 4816 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4260 wrote to memory of 3092 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 79 PID 4260 wrote to memory of 3248 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 80 PID 4260 wrote to memory of 1676 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 81 PID 4260 wrote to memory of 2204 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 82 PID 4260 wrote to memory of 4816 4260 2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe 83 PID 3092 wrote to memory of 1180 3092 gwknhzcxjw.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_5c81c558cf8c82dcb91c03b34abe1dc7_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\gwknhzcxjw.exegwknhzcxjw.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\cjlfnsve.exeC:\Windows\system32\cjlfnsve.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1180
-
-
-
C:\Windows\SysWOW64\aanwhwzxegvchak.exeaanwhwzxegvchak.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3248
-
-
C:\Windows\SysWOW64\cjlfnsve.execjlfnsve.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1676
-
-
C:\Windows\SysWOW64\bgjlwtkiflcgc.exebgjlwtkiflcgc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2204
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4816
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 514KB
- SHA256 0ab2783d8befcda5fd6229cfdc4de9dd88b549d426cdb23c8bb77fb5ee22067b
- MD5 f3f048b0c5c567984da46cc62992efba
- SHA1 efdea51ed41dba7e98d648e27590da008e393771
- SHA512 9d97a24512ccc95235297afed7ec3954feb0da86d1a433d73c64dd2eae8062d0188f1efee38dd566178949b466f531ed87f61430ce0a0d580d8b3046ac2abb53
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5X
- TLSH T1C3B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 514KB
- SHA256 bdfc872b3be8535cf0c0a734eb8ae6d5b92ce0b6c49624cd7e8e47e43e1c7042
- MD5 eb2c9652534c119151721c8e86df75dc
- SHA1 4d881ee6c1196fd4ca8af08e3d6ddb1e1ca8e72c
- SHA512 533d522682e83f03dbcd5d0ed0002303ad20fbe9f46169e2e3f31eef7363ca6a39e52f0988614a5883634455c2ef942266ff8cedecdd39c0d442f010f5ed9566
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R
- TLSH T1C8B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 257B
- SHA256 ff011b7f747f53912f387fcbd431a7a2ec1e9b8f70efebf9817a3bc75493a08c
- MD5 694edd3ef13247806945799ef8c97bb3
- SHA1 16c2d04adcd952543e5c020fd5501c8531876480
- SHA512 a08118d3c0046e6f81dbcd0c38aa3f4fe9224a257a390a31f3b77e1f34e3b371d95d60e607284704795342d3ae7e8d6421390a6854ee8535e3dbbbff70d61b27
- TLSH T1F2D0179B6712F3E213BC920838382DE4AFE308A0E249806042DC8C492C21D93606B589
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- TLSH T15B346895A6DACF144B71F23FD8B53492EA1DC87B29342D41F1DC733717AE948822B622
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 2132b19a383f0e6090d5d3189dd8c2b541b981184fdd853212dcda640a5a70f0
- MD5 2d141b9cd582851e92a72a4a3b76b84b
- SHA1 e49ba8b45ac6afa05aeeb29f048567951473855c
- SHA512 883c76b0eb76c5b69a59317d997f56505f7e67b9f4b208d37f08a32a08bf3cf535498c33b756d0c41d334ebf7f17edaae8dda75f1905bb17bb1d874f70b51fe9
- TLSH T1804132134B970F97F0504236912A3748EB307CC6F3AC221D4788D24ABF71D426E9EB69
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 7d090cedc6bda44bc7fb6907b61e87342ed6f139b768f1aff6b1c9dc3b55f038
- MD5 949e0c5370259050d5553237e4390cb8
- SHA1 581a01532c844d30acc1bde0a406976ad0f57f69
- SHA512 cea6b75c84cd727a21e0f3e01879d27280f899016f47423805bd382e7457eb66424ca39f2eb04354ab04d5c22c6cdc0c8f4c8fbc3c6dc2219cddc650bb9cc0d9
- TLSH T1865154524B974FA3F0504231511A3314EB307DC6F3AC261E0648E246BF71D426E4E76A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\aanwhwzxegvchak.exe
- Size 514KB
- SHA256 2b86cfd8fc6db6096c58ac815ff7bb5c04c7884161dbab2d63f9de7cccc973ed
- MD5 102993399c8a115a397ee3e64b64acd8
- SHA1 b928d4731bcff8d194fab3ca3440b646b826dd75
- SHA512 0448c0c64b4aa349c0b30c61ff45462d0f0a78e189ebce543cc77101e9e94c2310fc25548ec36b6da349fedd6e478fe24e19eacc5614ae01946534b7410e463a
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6G:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5v
- TLSH T11CB4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\bgjlwtkiflcgc.exe
- Size 514KB
- SHA256 26207891da785e5ce2ac8861b7df8f8a1523538e9ff917e0755d8dcb873e94ca
- MD5 53373472de38dcd2c84b90a5fe654e2b
- SHA1 7e30026d18f8cd03798969afaed56953567cca6d
- SHA512 a2f186cd6f1c3a5716ad9a7ed711440acfc9f4a2a7d05c154c7d1c39a890fd917c1f8366703f13c51957bb33ab1268aec63076eef26f0e7688c1c9f341c57514
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
- TLSH T1B3B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\cjlfnsve.exe
- Size 514KB
- SHA256 95c7c65eabae43ff066bf0ca42f373674bb1a09bb58e487323c9b6bbc4e14f99
- MD5 82b1d90bef057d4529e32a8acbfa8713
- SHA1 5a8ba1878d56061b6ce09d34af6607fd823daab5
- SHA512 bc35155fd3f6bb3452708ab657c1231784dfda8d8024fdee92a29928b939cf3e0016f2a5fc6aba2c61e59eec9e01741bb8a0375c781b48375a47a8dc9e618a67
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x
- TLSH T152B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\gwknhzcxjw.exe
- Size 514KB
- SHA256 f87a4a71027ab0583c37e0a1d7407713e76b2b9a8dc7c2eee7966a2b0d3de9cf
- MD5 be849a7eec58e109e6a7b4b49625a871
- SHA1 8a86b75d99b7f3d7a152bc03329be75a9ca313ad
- SHA512 34a56382a7c55c8efcdf07d070ad13065618b101115f816ff4c22847d7b6d591ae78f1f5378ae5eb0b03cff6c7f4b8b1a0c383fe6953c3b1f5dc88d9760fa17c
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6P:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+
- TLSH T16DB4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 514KB
- SHA256 a597bdbac00f26e0741d25c8bf70a8a89e696bb10e1586a1976c9a7d459bcd1d
- MD5 5c4fb4dde21decc78e044894acee8d53
- SHA1 32bf585c4676df919038c3ea71d98bb37b3adadd
- SHA512 7456ae03bf2d9af1bb293a0ee9809e678eb46f9f6c0736d78c8b6ebbf99c35c1d896ff5d8d502e26c64934f75d9fb8595ee8c890efc0a83091084cecb0b09523
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm57
- TLSH T175B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 514KB
- SHA256 a34ab93b1089fb7d7e069ca78f854fb809939b6d3da6fd3ea794113d0f07b93f
- MD5 24c759a64135b01b2853dd2632d91690
- SHA1 523ca21b0a227d532a556528688a070de7195fb9
- SHA512 c5e81480c3d37641be2a4b5acabd358a910754cdda45abed236c02101d3bf0d6ed239e60c2a77892fd477d0345708eccb4e72f9eee0c9a0194a45085095bd8c1
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6Q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
- TLSH T103B4BF2276E1B0B2E96325F00F76D729E777BC3056359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH