Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 08:42
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
25 signatures
150 seconds
General
- Target 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe
- Size 512KB
- Sample260629-klzdnahs8v
- SHA256 ea6b44b8b998a589ba352146844fe1f7a926c6bcbf3b31e19bb54b4319a5b038
- MD5 31ef1146f54876e13c96e80f636017fc
- SHA1 4602c28aa399febeea5fac72d2ef961492d6d670
- SHA512 f547b50b2159dc88e8f7151e4e6a7836e29bf0c10d9dd786eb582fcb8ed77eabe4c9c5b9c0693c22c94d1cb880b0c2c6a1d6c2446041a7ce5737fd90b1871b39
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6C:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5D
- TLSH T1D6B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tgdezmoepv.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tgdezmoepv.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tgdezmoepv.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tgdezmoepv.exe - Executes dropped EXE 5 IoCs
pid Process 948 tgdezmoepv.exe 1328 uaycdphmtquzcvc.exe 5472 btwcwuak.exe 5148 nfxorrivpvroj.exe 4740 btwcwuak.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tgdezmoepv.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\edzxetzv = "tgdezmoepv.exe" uaycdphmtquzcvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\porqimgd = "uaycdphmtquzcvc.exe" uaycdphmtquzcvc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "nfxorrivpvroj.exe" uaycdphmtquzcvc.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: btwcwuak.exe File opened (read-only) \??\b: tgdezmoepv.exe File opened (read-only) \??\u: tgdezmoepv.exe File opened (read-only) \??\d: btwcwuak.exe File opened (read-only) \??\o: btwcwuak.exe File opened (read-only) \??\n: btwcwuak.exe File opened (read-only) \??\j: btwcwuak.exe File opened (read-only) \??\g: tgdezmoepv.exe File opened (read-only) \??\a: btwcwuak.exe File opened (read-only) \??\w: btwcwuak.exe File opened (read-only) \??\i: btwcwuak.exe File opened (read-only) \??\p: btwcwuak.exe File opened (read-only) \??\m: btwcwuak.exe File opened (read-only) \??\n: btwcwuak.exe File opened (read-only) \??\t: tgdezmoepv.exe File opened (read-only) \??\v: tgdezmoepv.exe File opened (read-only) \??\b: btwcwuak.exe File opened (read-only) \??\d: btwcwuak.exe File opened (read-only) \??\v: btwcwuak.exe File opened (read-only) \??\a: btwcwuak.exe File opened (read-only) \??\a: tgdezmoepv.exe File opened (read-only) \??\h: tgdezmoepv.exe File opened (read-only) \??\i: tgdezmoepv.exe File opened (read-only) \??\k: tgdezmoepv.exe File opened (read-only) \??\s: tgdezmoepv.exe File opened (read-only) \??\q: btwcwuak.exe File opened (read-only) \??\v: btwcwuak.exe File opened (read-only) \??\l: btwcwuak.exe File opened (read-only) \??\n: tgdezmoepv.exe File opened (read-only) \??\q: tgdezmoepv.exe File opened (read-only) \??\y: tgdezmoepv.exe File opened (read-only) \??\z: tgdezmoepv.exe File opened (read-only) \??\k: btwcwuak.exe File opened (read-only) \??\s: btwcwuak.exe File opened (read-only) \??\b: btwcwuak.exe File opened (read-only) \??\p: tgdezmoepv.exe File opened (read-only) \??\x: tgdezmoepv.exe File opened (read-only) \??\g: btwcwuak.exe File opened (read-only) \??\z: btwcwuak.exe File opened (read-only) \??\h: btwcwuak.exe File opened (read-only) \??\q: btwcwuak.exe File opened (read-only) \??\r: tgdezmoepv.exe File opened (read-only) \??\h: btwcwuak.exe File opened (read-only) \??\l: btwcwuak.exe File opened (read-only) \??\u: btwcwuak.exe File opened (read-only) \??\z: btwcwuak.exe File opened (read-only) \??\d: tgdezmoepv.exe File opened (read-only) \??\i: btwcwuak.exe File opened (read-only) \??\k: btwcwuak.exe File opened (read-only) \??\t: btwcwuak.exe File opened (read-only) \??\x: btwcwuak.exe File opened (read-only) \??\w: tgdezmoepv.exe File opened (read-only) \??\u: btwcwuak.exe File opened (read-only) \??\y: btwcwuak.exe File opened (read-only) \??\j: btwcwuak.exe File opened (read-only) \??\r: btwcwuak.exe File opened (read-only) \??\j: tgdezmoepv.exe File opened (read-only) \??\p: btwcwuak.exe File opened (read-only) \??\g: btwcwuak.exe File opened (read-only) \??\w: btwcwuak.exe File opened (read-only) \??\l: tgdezmoepv.exe File opened (read-only) \??\o: tgdezmoepv.exe File opened (read-only) \??\y: btwcwuak.exe File opened (read-only) \??\m: tgdezmoepv.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" tgdezmoepv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" tgdezmoepv.exe - AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/5904-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000c00000001c660-5.dat autoit_exe behavioral2/files/0x000900000001a2b8-11.dat autoit_exe behavioral2/files/0x000d00000001c65c-18.dat autoit_exe behavioral2/files/0x000c00000001c661-27.dat autoit_exe behavioral2/files/0x000c00000001c674-56.dat autoit_exe behavioral2/files/0x000d00000001c676-78.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe btwcwuak.exe File opened for modification C:\Windows\SysWOW64\uaycdphmtquzcvc.exe 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\btwcwuak.exe 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\nfxorrivpvroj.exe 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll tgdezmoepv.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe btwcwuak.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe btwcwuak.exe File created C:\Windows\SysWOW64\tgdezmoepv.exe 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\tgdezmoepv.exe 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe File created C:\Windows\SysWOW64\uaycdphmtquzcvc.exe 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe File created C:\Windows\SysWOW64\btwcwuak.exe 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe File created C:\Windows\SysWOW64\nfxorrivpvroj.exe 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal btwcwuak.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe btwcwuak.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe btwcwuak.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe btwcwuak.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe btwcwuak.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal btwcwuak.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe btwcwuak.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe btwcwuak.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe btwcwuak.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe btwcwuak.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe btwcwuak.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal btwcwuak.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe btwcwuak.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal btwcwuak.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe btwcwuak.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe btwcwuak.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe btwcwuak.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe btwcwuak.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe btwcwuak.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe btwcwuak.exe File opened for modification C:\Windows\mydoc.rtf 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe btwcwuak.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe btwcwuak.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btwcwuak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tgdezmoepv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uaycdphmtquzcvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btwcwuak.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfxorrivpvroj.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F46BB1FF6E22D0D20CD1D18B089017" 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs tgdezmoepv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg tgdezmoepv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472C7F9C2D83236D3676DD70522CDB7C8E65DF" 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCFFACCFE64F1E383743A4186EC39E3B38B038A42140233E1CD45E608A9" 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe Key created \REGISTRY\USER\S-1-5-21-2882181966-868590553-1461876573-1000_Classes\Local Settings 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" tgdezmoepv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B02E4490399A52C9B9D732EDD7CD" 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193FC67E14E0DBC5B8CD7CE9EDE034CD" 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh tgdezmoepv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" tgdezmoepv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc tgdezmoepv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" tgdezmoepv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf tgdezmoepv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" tgdezmoepv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat tgdezmoepv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" tgdezmoepv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" tgdezmoepv.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFFFFF84F28851E9041D65A7D9CBC92E632584166456331D79E" 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5840 WINWORD.EXE 5840 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 4740 btwcwuak.exe 4740 btwcwuak.exe 4740 btwcwuak.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 1328 uaycdphmtquzcvc.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 948 tgdezmoepv.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5472 btwcwuak.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 5148 nfxorrivpvroj.exe 4740 btwcwuak.exe 4740 btwcwuak.exe 4740 btwcwuak.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5840 WINWORD.EXE 5840 WINWORD.EXE 5840 WINWORD.EXE 5840 WINWORD.EXE 5840 WINWORD.EXE 5840 WINWORD.EXE 5840 WINWORD.EXE 5840 WINWORD.EXE 5840 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5904 wrote to memory of 948 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 90 PID 5904 wrote to memory of 1328 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 91 PID 5904 wrote to memory of 5472 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 92 PID 5904 wrote to memory of 5148 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 93 PID 5904 wrote to memory of 5840 5904 2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe 94 PID 948 wrote to memory of 4740 948 tgdezmoepv.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_31ef1146f54876e13c96e80f636017fc_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\SysWOW64\tgdezmoepv.exetgdezmoepv.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\btwcwuak.exeC:\Windows\system32\btwcwuak.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4740
-
-
-
C:\Windows\SysWOW64\uaycdphmtquzcvc.exeuaycdphmtquzcvc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1328
-
-
C:\Windows\SysWOW64\btwcwuak.exebtwcwuak.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5472
-
-
C:\Windows\SysWOW64\nfxorrivpvroj.exenfxorrivpvroj.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5148
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5840
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 4KB
- SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
- MD5 5f036f91e86e30f749961506951d51eb
- SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
- SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
- SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
- TLSH T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 307B
- SHA256 84b01f716d951ac204272d710c05b24b38c26fc30cacec028ceb6a323a3541aa
- MD5 5e77a85f614d918086767832019c4bf0
- SHA1 662c466c3e25633320a9f42ab4e08bc19d0e05db
- SHA512 22b780ed831be2ab4109ddbc59d14b738ec5e7ba049c76094e2a1b78d5e93eb0f85f7d42ffea332dcc31109423cb8ab1744159de61dbef8828a38d71552d26af
- TLSH T149E05B172F69E7F183BD91B8BDB85CD557F39CA8D17C017311DC0C420CA22430887505
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 57561248b6576fd55d9568393704415e09ff9ebd6341fb20835d10eb56fed522
- MD5 8a59416982c5980f067929c3d3facb38
- SHA1 a84c2c2f216022693bc245cd5c5b8715b8c323a8
- SHA512 64a326ccb3dfc016b6967f45b3575eb2b2ab8581afe4fe99b4712ec08c5c3f9ac29233682c756deafd0a2121c812cfdc21c01151a7948537a23b7af51ad95691
- TLSH T15A51EE019A5F3FBAE088C239132AC352EB317D43E2005B2E2548351A6C26D92DF8DB5D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 1KB
- SHA256 b0c341b85ec277474e5ff9c7baa933c455460dd73d2ebcc11dcc3d5aa46508f5
- MD5 940a9615d62e35c94257551c3b06f3a4
- SHA1 7dba7199e8e089c0e9d1edbced39734b5a8c3b4b
- SHA512 7985e92de47dd7f39fda21e86f5b1a5cc84c6ec1816d0258a71a23c8b8dbeeffd9e6bf6c15fcc8256f4ed3be4fa26171876465a48ef5de542222299aecbec987
- TLSH T1C241BC019A9F3F7AE09882391339C356EA317D47E2406B2E6648351A2C26D92DF8DF59
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PushInitialize\UninstallSet.doc.exe
- Size 512KB
- SHA256 8a006ad97b56c255c57e904ff88594020f9d2043bb909b1d91855bda899d1f5e
- MD5 53c2038edc293fa649e5a8c3a36bd209
- SHA1 6684759893e486384300d238714965576eb12810
- SHA512 bc1f854161f164533d513b0f2587533ca1c6466935e8c2f7230c30ae743e625698a30f51932445bfda832b3ac4e7e9c8f81a21b431ded8268341bb28e4e517e7
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b
- TLSH T14CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\btwcwuak.exe
- Size 512KB
- SHA256 386fb8bfa7d3477afed24f9255fda38af100c52dfc7129546aef3f135d8dcd62
- MD5 c93ef8733adf12f52703cb4d3d269823
- SHA1 b552bd21ec8fc5ce03668e47946cfa792693fafb
- SHA512 db74a68f6a0b601669af97da282e64cf3069c8dc4dcc8b16466c319cef8a495d5b9775a096d49d78377bf645e40cf4630c0ba2a1bfabe259bca24727c6af74fc
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6H:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Q
- TLSH T1EBB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\nfxorrivpvroj.exe
- Size 512KB
- SHA256 0cd85767a1d1f8faa7767bdd3b4a5f9deda89d1b71b6f8ef09dbb4439155c8cb
- MD5 c42683d65791290cb4d131c0b381e24a
- SHA1 d9164c52c789313727f019c67339a31476a37b31
- SHA512 718785eb8691c4c4ae1aed7845f248e409208239eb1de323b45ee89e8854085714a79cc4e5f604079f2701909c83038ed65f3466f7347601f37c1876952f8cbe
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6W:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5B
- TLSH T1F0B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\tgdezmoepv.exe
- Size 512KB
- SHA256 42a67fd76bbd25d4663ee3cebb69b66da56ae8f3e571c469601121581dea9e8e
- MD5 e21bc81e106d40e5ad5bdc0969df322c
- SHA1 28112f5636738e3644b30b2ff2816a51ef29b84c
- SHA512 d9cb3cbfd4f8e7dcae717f609086704211b1b4a1af2025084391bc821b05961cd6d198a716fb29f6755341618f25ad1f38a8ce7d8688e839708b6196b3c0c79b
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5J
- TLSH T17FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\uaycdphmtquzcvc.exe
- Size 512KB
- SHA256 405e8aff0545b41763d5be5cbd18e4b7a92e7c3c669ee5daa17b1b92b8b51bae
- MD5 36429e7a6be9196090b8611b4c390875
- SHA1 23339728d4b72651d724e757c31678a4d3a0f68b
- SHA512 1a3298e3e7177b085b4854e4a2804ee6d8a76db71ab12b36cc3e75361c8060ff65d52370b0a88e8fb970cbc031218f0e7ef9616c4c4988d14b1a7fcef760117d
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6A:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
- TLSH T1D2B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 d7ae98c693f7ddad3051944598164813b3b88be63c44ebeebb021a695729f328
- MD5 2629b40d750fddcba16841c06a268146
- SHA1 91d8d4a05840a01455584e740694e940cdc649af
- SHA512 63ebe061f661f28915062db22754a5fca9f2f313ddf7d72ca0822ba0ac509f3f07bdfb3d167dbe675067d8cdad44a3b6e44edd611152328dc9e21338314f7da1
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6x:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58
- TLSH T1BCB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH