Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 03:53
Behavioral task
behavioral1
Sample
2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe
- Size 512KB
- Sample260629-efrtqsdx7k
- SHA256 aca8baa513cab8f4c813e6a9e12ac94b0c5d8b5b231fe693cfb8f58b8c4db87c
- MD5 af62613861f891fc03ebb486c27707f7
- SHA1 8762af529467c2c06e9cd8ec293a24564913bf64
- SHA512 5a47067b255a47fcaab193ef03395ec2fb3c5360ee56fd0467700a457e1c6b4de2be968f93342148b9498486f85120962e61c416072cc20ecb8a0361e5b955ee
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5a
- TLSH T144B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 10 IoCs
resource yara_rule behavioral2/files/0x000c00000001c6d9-5.dat family_sohanad behavioral2/files/0x00150000000118da-10.dat family_sohanad behavioral2/files/0x000d00000001c6d5-17.dat family_sohanad behavioral2/files/0x000c00000001c6db-27.dat family_sohanad behavioral2/files/0x0005000000000424-59.dat family_sohanad behavioral2/files/0x000300000001b2df-62.dat family_sohanad behavioral2/files/0x000c00000001c6f5-74.dat family_sohanad behavioral2/files/0x000c00000001c6f6-77.dat family_sohanad behavioral2/files/0x001a00000001c70b-511.dat family_sohanad behavioral2/files/0x001a00000001c70b-516.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" bpzszixiut.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bpzszixiut.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" bpzszixiut.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bpzszixiut.exe - Executes dropped EXE 5 IoCs
pid Process 1884 bpzszixiut.exe 1524 aplprhmnqjncdrv.exe 1240 frohioto.exe 2432 unoatqqhgmpwc.exe 2924 frohioto.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" bpzszixiut.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\yubenjth = "bpzszixiut.exe" aplprhmnqjncdrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\swoqmqpn = "aplprhmnqjncdrv.exe" aplprhmnqjncdrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "unoatqqhgmpwc.exe" aplprhmnqjncdrv.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: bpzszixiut.exe File opened (read-only) \??\y: frohioto.exe File opened (read-only) \??\h: frohioto.exe File opened (read-only) \??\q: frohioto.exe File opened (read-only) \??\x: frohioto.exe File opened (read-only) \??\q: bpzszixiut.exe File opened (read-only) \??\x: bpzszixiut.exe File opened (read-only) \??\y: bpzszixiut.exe File opened (read-only) \??\l: frohioto.exe File opened (read-only) \??\p: frohioto.exe File opened (read-only) \??\k: bpzszixiut.exe File opened (read-only) \??\u: bpzszixiut.exe File opened (read-only) \??\g: frohioto.exe File opened (read-only) \??\h: frohioto.exe File opened (read-only) \??\s: frohioto.exe File opened (read-only) \??\v: frohioto.exe File opened (read-only) \??\i: frohioto.exe File opened (read-only) \??\j: frohioto.exe File opened (read-only) \??\u: frohioto.exe File opened (read-only) \??\d: bpzszixiut.exe File opened (read-only) \??\v: bpzszixiut.exe File opened (read-only) \??\j: frohioto.exe File opened (read-only) \??\g: frohioto.exe File opened (read-only) \??\y: frohioto.exe File opened (read-only) \??\a: bpzszixiut.exe File opened (read-only) \??\h: bpzszixiut.exe File opened (read-only) \??\m: bpzszixiut.exe File opened (read-only) \??\m: frohioto.exe File opened (read-only) \??\d: frohioto.exe File opened (read-only) \??\w: frohioto.exe File opened (read-only) \??\p: bpzszixiut.exe File opened (read-only) \??\w: frohioto.exe File opened (read-only) \??\b: frohioto.exe File opened (read-only) \??\s: frohioto.exe File opened (read-only) \??\z: bpzszixiut.exe File opened (read-only) \??\i: frohioto.exe File opened (read-only) \??\t: frohioto.exe File opened (read-only) \??\z: frohioto.exe File opened (read-only) \??\v: frohioto.exe File opened (read-only) \??\b: bpzszixiut.exe File opened (read-only) \??\k: frohioto.exe File opened (read-only) \??\r: frohioto.exe File opened (read-only) \??\p: frohioto.exe File opened (read-only) \??\w: bpzszixiut.exe File opened (read-only) \??\l: frohioto.exe File opened (read-only) \??\m: frohioto.exe File opened (read-only) \??\n: frohioto.exe File opened (read-only) \??\o: frohioto.exe File opened (read-only) \??\q: frohioto.exe File opened (read-only) \??\r: bpzszixiut.exe File opened (read-only) \??\s: bpzszixiut.exe File opened (read-only) \??\b: frohioto.exe File opened (read-only) \??\k: frohioto.exe File opened (read-only) \??\g: bpzszixiut.exe File opened (read-only) \??\t: bpzszixiut.exe File opened (read-only) \??\d: frohioto.exe File opened (read-only) \??\n: frohioto.exe File opened (read-only) \??\u: frohioto.exe File opened (read-only) \??\x: frohioto.exe File opened (read-only) \??\o: bpzszixiut.exe File opened (read-only) \??\o: frohioto.exe File opened (read-only) \??\r: frohioto.exe File opened (read-only) \??\i: bpzszixiut.exe File opened (read-only) \??\l: bpzszixiut.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" bpzszixiut.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" bpzszixiut.exe - AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/6056-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000c00000001c6d9-5.dat autoit_exe behavioral2/files/0x00150000000118da-10.dat autoit_exe behavioral2/files/0x000d00000001c6d5-17.dat autoit_exe behavioral2/files/0x000c00000001c6db-27.dat autoit_exe behavioral2/files/0x0005000000000424-59.dat autoit_exe behavioral2/files/0x000300000001b2df-62.dat autoit_exe behavioral2/files/0x000c00000001c6f5-74.dat autoit_exe behavioral2/files/0x000c00000001c6f6-77.dat autoit_exe behavioral2/files/0x001a00000001c70b-511.dat autoit_exe behavioral2/files/0x001a00000001c70b-516.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe frohioto.exe File opened for modification C:\Windows\SysWOW64\bpzszixiut.exe 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\aplprhmnqjncdrv.exe 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe File created C:\Windows\SysWOW64\frohioto.exe 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\frohioto.exe 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll bpzszixiut.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe frohioto.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe frohioto.exe File created C:\Windows\SysWOW64\bpzszixiut.exe 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe File created C:\Windows\SysWOW64\aplprhmnqjncdrv.exe 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe File created C:\Windows\SysWOW64\unoatqqhgmpwc.exe 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\unoatqqhgmpwc.exe 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe frohioto.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal frohioto.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe frohioto.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe frohioto.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe frohioto.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal frohioto.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe frohioto.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe frohioto.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal frohioto.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe frohioto.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe frohioto.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe frohioto.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe frohioto.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal frohioto.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe frohioto.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe frohioto.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe frohioto.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe frohioto.exe File opened for modification C:\Windows\mydoc.rtf 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe frohioto.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe frohioto.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe frohioto.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe frohioto.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aplprhmnqjncdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frohioto.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unoatqqhgmpwc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frohioto.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpzszixiut.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33412D789D2382256D3676A0772E2CD77CF465DD" 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF4FF89482F8569903CD65F7E94BDE5E135594A66476242D7EE" 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh bpzszixiut.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" bpzszixiut.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" bpzszixiut.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB4F9CBF961F299840B3B32869639E6B38E02FE4366033AE1CA459B09D3" 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB6B02847E139EA53BEBADD33EAD7C9" 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193AC70F15EDDBC5B8C97FE5EC9E34C7" 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat bpzszixiut.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc bpzszixiut.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg bpzszixiut.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08168B0FE6621DDD27ED0A48B7D9162" 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" bpzszixiut.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" bpzszixiut.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf bpzszixiut.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs bpzszixiut.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" bpzszixiut.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" bpzszixiut.exe Key created \REGISTRY\USER\S-1-5-21-3839916939-1319118069-2256772647-1000_Classes\Local Settings 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5348 WINWORD.EXE 5348 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1240 frohioto.exe 1240 frohioto.exe 1240 frohioto.exe 1240 frohioto.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1240 frohioto.exe 1240 frohioto.exe 1240 frohioto.exe 1240 frohioto.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2924 frohioto.exe 2924 frohioto.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1240 frohioto.exe 1240 frohioto.exe 1240 frohioto.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2924 frohioto.exe 2924 frohioto.exe 2924 frohioto.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1884 bpzszixiut.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1524 aplprhmnqjncdrv.exe 1240 frohioto.exe 1240 frohioto.exe 1240 frohioto.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2432 unoatqqhgmpwc.exe 2924 frohioto.exe 2924 frohioto.exe 2924 frohioto.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5348 WINWORD.EXE 5348 WINWORD.EXE 5348 WINWORD.EXE 5348 WINWORD.EXE 5348 WINWORD.EXE 5348 WINWORD.EXE 5348 WINWORD.EXE 5348 WINWORD.EXE 5348 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 6056 wrote to memory of 1884 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 90 PID 6056 wrote to memory of 1524 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 91 PID 6056 wrote to memory of 1240 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 92 PID 6056 wrote to memory of 2432 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 93 PID 6056 wrote to memory of 5348 6056 2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe 94 PID 1884 wrote to memory of 2924 1884 bpzszixiut.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_af62613861f891fc03ebb486c27707f7_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6056 -
C:\Windows\SysWOW64\bpzszixiut.exebpzszixiut.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\frohioto.exeC:\Windows\system32\frohioto.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2924
-
-
-
C:\Windows\SysWOW64\aplprhmnqjncdrv.exeaplprhmnqjncdrv.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1524
-
-
C:\Windows\SysWOW64\frohioto.exefrohioto.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1240
-
-
C:\Windows\SysWOW64\unoatqqhgmpwc.exeunoatqqhgmpwc.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2432
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5348
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 b8926a9e0b4e5246c47d893242f37addeb54bcdb3a967e0074d9dfb81b279678
- MD5 2d4464518832e5dd86f2eec5a82ffed3
- SHA1 07f9b6c4e88a1dba5d809678a0fac74642231209
- SHA512 cc7253653158fbf3182479a4fd24eaf99b270b338f1ccdd2cc61c533c67c9456679fd47e19a5cf6f26a24a8d9b4151f7b9185f97100925a4c58eae5195f60bde
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6P:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
- TLSH T15AB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 512KB
- SHA256 5b9fb37ca1fca08379fd1136fe4642f0c770d9138bec1f3e678493424802b824
- MD5 ef958d7117178ab3eba5f8954d1621d8
- SHA1 365c3aadc04fefb1fe68f800fbcd4a5c54b105f2
- SHA512 2eede037498cb6e5605e52814330329069f788b2e588bff0ab38202a4d0b3800eae83638cdacd85006d04e1ea54aa5d12d6d82b76923e108ca2d608299654c64
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5T
- TLSH T18DB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TCDFFD8.tmp\gb.xsl
- Size 262KB
- SHA256 6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
- MD5 51d32ee5bc7ab811041f799652d26e04
- SHA1 412193006aa3ef19e0a57e16acf86b830993024a
- SHA512 5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
- SSDEEP 6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
- TLSH T19A4458A5E6D9CF144BB1F23FD8B52092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 243B
- SHA256 d3ccf74f0e240cb02b98fc4bba6fe605b7811d51b950acb0f81077021eaeaa65
- MD5 a4c381bcdac4f0ec73bd2583da50bd24
- SHA1 1debe83cc19b5da582514ae9e278587b8a9127e5
- SHA512 392a7462c6426feee083b8ef2cd235cd908cbe1907c2cf1f052acbf885de8e4f04d939fa86db647487cd4f26bf3efbcedd1349ba31221db814525e674b072703
- TLSH T1EFD0C97BAB39EFF1937D96EC38399DF45BF2496CE6AA212100CC4D861C60A93259F501
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 649B
- SHA256 6b74f8f71a27ba4db7553d38f74609eba72f3320eff01e33d0a8fb3ade5ef06e
- MD5 b7b2bc1c0c21405b750fa2c88f207fc7
- SHA1 e1e21686a203d72df90584a527bc02a72e2addc8
- SHA512 f7d9df8ba8fab716e7dfa3cc7982a86b1c7c3a0aa226bd5950547583c51d3f69ef29511bb2c5bd9524d84eeef21c15d597a17903068e5bf7aac7cef9df25bcb4
- TLSH T1E1F0EB036A9E1B1AD0A153BA963A8B0DC5317805D200938FD708643AAC60C40BF8D79A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 5325a12c6ca65ecbd5cd62c8ae248978efdd84852df94114c013c8dc650eb082
- MD5 1c20dd513f41f8cfaf7f022576e3988a
- SHA1 fad791878e149c87b236ee2cd93f3a1d2c0a8a67
- SHA512 cadf46f5f692622a22e4ab14b6e531e8f24bee66a883d17d781bb990c78d09c32489f02cad0ad02bfd55a84164f5bd3e35e99646ccbd1c44bd10ee27d03c1cda
- TLSH T1882175021A5F4B11D0D15336516F9319DB31BC07E304878F8708732BBC60C00FE4D29A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\RedoCompress.doc.exe
- Size 512KB
- SHA256 831e0ad353811b2d6b25b8d5862004b539c97743934804d2eb35b6599e7a5da0
- MD5 adbda48352a1cbcb3f71463da4a4b784
- SHA1 2b7dde456c4e938ccdf2e566f064abc8d8fef183
- SHA512 322cc5c31e7412615cafd4e68b643ec355ddc0a6453bb4cd810eb4bdf4695e74e5a4c775ccabf15bb669e9b16728a3618141b0732b15c9aba6f7ec6613e594d7
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
- TLSH T11DB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\RepairMount.doc.exe
- Size 512KB
- SHA256 8c934b119fbee9f419e5775e748986ae5756c7ad325c5c1f5e88247bab9d3ecc
- MD5 b60d5b196d839e5f45b458fdd0d268bb
- SHA1 6c33885d98ab89456857c931e0ac3419d31ccbdc
- SHA512 fd63319baf5b832b046b45b106759b73ed08cfca474cfdb3c2fc48ae34326d8ab7f6cce4acafd1d551211abaa6a2b81d3ebdb67dbf1d5c0aa185039731635d3b
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- TLSH T1E1B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\aplprhmnqjncdrv.exe
- Size 512KB
- SHA256 aee8450f29892f233f4fa6ecf4cdeadfa50e82e4c68de1ade73a974404c8f41f
- MD5 42bf2528d9f6b91f87bfa0afcf768cd9
- SHA1 4139cec6e1af67436e3b6bfb54794fcd53e3fd75
- SHA512 eb2620487a2946209691e2dc2babe96f7da0ff89785a5da5256d8528a0135adc43bdfdf73db538bca11c9eca40f2b2a34dfce618e9431cab71293cc33265a577
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5j
- TLSH T16FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\bpzszixiut.exe
- Size 512KB
- SHA256 30ed0d57638c86f331580dfaa0eb11ac4d365cf5d8591bdab3041702b8ff143b
- MD5 aba2e0dce2a51aeb47586147c04079b7
- SHA1 a79964412019ab33eb4156c6b9bda3362ef94f41
- SHA512 db655e097afb1ad6825b96868defc5ac9d621f582899eb0cb1870f07671feb64fdb32bf12cb02ff7300605e6c307b76eb9920b24577fdda0bb991110372a0edb
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm50
- TLSH T17DB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\frohioto.exe
- Size 512KB
- SHA256 a18f13d7813f57753134eee2aeb65a0555ba5da34e6e1acf879913e00f76d0f6
- MD5 807e140cf8db8a8f5c47a3f0aa2c01e8
- SHA1 ed8b61bdda588dfb09d5e77173316b75de760a37
- SHA512 b7c8dcd4dc2fb9d882caa20d8e3acef613f27e63293ee066300c762424f5015629f60fa15a597c53ca8d810d988f7e00e93dcb5601f52cfeac524ffe3a3776a4
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6S:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
- TLSH T183B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\unoatqqhgmpwc.exe
- Size 512KB
- SHA256 2cd303e3b8750b40089d202b6492b507990495756b4527be7a3f1d3020ebdb63
- MD5 25cb075fc4dfe30a8b93bebaa3e8b831
- SHA1 2adab417d45d39e529920ef14240042d62725785
- SHA512 3946b602e2de27a8f7485c24b30a1663fb19e6b7680dac2f8bb7feb586dfa2141314bace678eb49c315aa4c8ec62484bd84c0178fe2d0cc0a4ae0d3eb3cc843b
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- TLSH T103B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 1ebbf452ca474fb54451fc9f9cf64f0e1d27e04252432d1a77c08d36b8fece05
- MD5 2d668d7f059a1d488fe789d2f3a5436d
- SHA1 70fdd2d3a978985c7f9c33a8acadee52d799b22c
- SHA512 143d9505cd04e4ae4ba8d311a23e58d2e1dfd427e9ae3e1c01c9b81a448c2955feb71cf0d39cff414bba7a98b8fc56668ff048c17bbafc56c8d47bbedcf02c36
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P
- TLSH T1B8B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 e0d7e34baca215e254bb7ad210c521c54cffcc3c0ae6d8da7805babae0f25c77
- MD5 e4b6c6bc957e5135bfe3772d22be7c11
- SHA1 8e388a0c35ad824014e742d8e7a14f191c9e2cac
- SHA512 ee52ce828fc2381a169c3957867c64decb195fa344f3e72ac8edece89be2f8cf0d4f2ba7f0de0ae35220266bf412ebf38ea0f21e5a2d440e020d1fe09f9956e3
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6e:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l
- TLSH T15AB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH