Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 14:28
Behavioral task
behavioral1
Sample
2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe
- Size 512KB
- Sample260820-rtbqwsstfs
- SHA256 3d3eb2574dceeb869cc80be0217727d01a30c284750ceef1cc5f205976f3ad5e
- MD5 d0a54a2ea47fe92c6bc28fbf1bad900c
- SHA1 883457bdc21c520f31397f85118e77d5e973bc9c
- SHA512 89c477b198694405a83ada4afd5a6d84bf0c83f6eb2e23bda3118b116395a51785b6f87457b30701b62fd627678386f553ed480f7569099f4f094d43a681792f
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6M:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x
- TLSH T1CEB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sohanad worm 9 IoCs
resource yara_rule behavioral2/files/0x000c00000001c5f6-7.dat family_sohanad behavioral2/files/0x000d000000016cfd-11.dat family_sohanad behavioral2/files/0x000d00000001c5f1-17.dat family_sohanad behavioral2/files/0x000c00000001c5f5-22.dat family_sohanad behavioral2/files/0x000e00000001c605-72.dat family_sohanad behavioral2/files/0x000e00000001c607-76.dat family_sohanad behavioral2/files/0x000e00000001c608-79.dat family_sohanad behavioral2/files/0x0003000000000438-96.dat family_sohanad behavioral2/files/0x0003000000000438-101.dat family_sohanad - Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" hdhuzmlujd.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" hdhuzmlujd.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hdhuzmlujd.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hdhuzmlujd.exe - Executes dropped EXE 5 IoCs
pid Process 1480 hdhuzmlujd.exe 1136 dpwzsomelpnuumi.exe 4804 ezjavxlg.exe 3952 tshqnoalzzpfw.exe 3036 ezjavxlg.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" hdhuzmlujd.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rdelqpnf = "hdhuzmlujd.exe" dpwzsomelpnuumi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qbkzzezq = "dpwzsomelpnuumi.exe" dpwzsomelpnuumi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tshqnoalzzpfw.exe" dpwzsomelpnuumi.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\d: hdhuzmlujd.exe File opened (read-only) \??\g: ezjavxlg.exe File opened (read-only) \??\s: hdhuzmlujd.exe File opened (read-only) \??\z: hdhuzmlujd.exe File opened (read-only) \??\t: ezjavxlg.exe File opened (read-only) \??\l: ezjavxlg.exe File opened (read-only) \??\d: ezjavxlg.exe File opened (read-only) \??\j: hdhuzmlujd.exe File opened (read-only) \??\z: ezjavxlg.exe File opened (read-only) \??\b: ezjavxlg.exe File opened (read-only) \??\n: ezjavxlg.exe File opened (read-only) \??\y: ezjavxlg.exe File opened (read-only) \??\l: hdhuzmlujd.exe File opened (read-only) \??\y: hdhuzmlujd.exe File opened (read-only) \??\h: ezjavxlg.exe File opened (read-only) \??\j: ezjavxlg.exe File opened (read-only) \??\k: ezjavxlg.exe File opened (read-only) \??\x: ezjavxlg.exe File opened (read-only) \??\h: hdhuzmlujd.exe File opened (read-only) \??\m: ezjavxlg.exe File opened (read-only) \??\n: ezjavxlg.exe File opened (read-only) \??\v: ezjavxlg.exe File opened (read-only) \??\x: ezjavxlg.exe File opened (read-only) \??\o: hdhuzmlujd.exe File opened (read-only) \??\a: hdhuzmlujd.exe File opened (read-only) \??\i: hdhuzmlujd.exe File opened (read-only) \??\r: hdhuzmlujd.exe File opened (read-only) \??\k: ezjavxlg.exe File opened (read-only) \??\u: ezjavxlg.exe File opened (read-only) \??\w: hdhuzmlujd.exe File opened (read-only) \??\m: ezjavxlg.exe File opened (read-only) \??\o: ezjavxlg.exe File opened (read-only) \??\q: ezjavxlg.exe File opened (read-only) \??\t: hdhuzmlujd.exe File opened (read-only) \??\p: ezjavxlg.exe File opened (read-only) \??\r: ezjavxlg.exe File opened (read-only) \??\s: ezjavxlg.exe File opened (read-only) \??\u: ezjavxlg.exe File opened (read-only) \??\a: ezjavxlg.exe File opened (read-only) \??\u: hdhuzmlujd.exe File opened (read-only) \??\x: hdhuzmlujd.exe File opened (read-only) \??\w: ezjavxlg.exe File opened (read-only) \??\g: ezjavxlg.exe File opened (read-only) \??\j: ezjavxlg.exe File opened (read-only) \??\b: hdhuzmlujd.exe File opened (read-only) \??\g: hdhuzmlujd.exe File opened (read-only) \??\a: ezjavxlg.exe File opened (read-only) \??\y: ezjavxlg.exe File opened (read-only) \??\r: ezjavxlg.exe File opened (read-only) \??\n: hdhuzmlujd.exe File opened (read-only) \??\q: hdhuzmlujd.exe File opened (read-only) \??\v: hdhuzmlujd.exe File opened (read-only) \??\q: ezjavxlg.exe File opened (read-only) \??\t: ezjavxlg.exe File opened (read-only) \??\z: ezjavxlg.exe File opened (read-only) \??\p: hdhuzmlujd.exe File opened (read-only) \??\v: ezjavxlg.exe File opened (read-only) \??\m: hdhuzmlujd.exe File opened (read-only) \??\k: hdhuzmlujd.exe File opened (read-only) \??\i: ezjavxlg.exe File opened (read-only) \??\l: ezjavxlg.exe File opened (read-only) \??\w: ezjavxlg.exe File opened (read-only) \??\h: ezjavxlg.exe File opened (read-only) \??\o: ezjavxlg.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" hdhuzmlujd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" hdhuzmlujd.exe - AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1924-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral2/files/0x000c00000001c5f6-7.dat autoit_exe behavioral2/files/0x000d000000016cfd-11.dat autoit_exe behavioral2/files/0x000d00000001c5f1-17.dat autoit_exe behavioral2/files/0x000c00000001c5f5-22.dat autoit_exe behavioral2/files/0x000e00000001c605-72.dat autoit_exe behavioral2/files/0x000e00000001c607-76.dat autoit_exe behavioral2/files/0x000e00000001c608-79.dat autoit_exe behavioral2/files/0x0003000000000438-96.dat autoit_exe behavioral2/files/0x0003000000000438-101.dat autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ezjavxlg.exe File opened for modification C:\Windows\SysWOW64\hdhuzmlujd.exe 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe File created C:\Windows\SysWOW64\dpwzsomelpnuumi.exe 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\dpwzsomelpnuumi.exe 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe File created C:\Windows\SysWOW64\ezjavxlg.exe 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe File created C:\Windows\SysWOW64\tshqnoalzzpfw.exe 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ezjavxlg.exe File created C:\Windows\SysWOW64\hdhuzmlujd.exe 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\ezjavxlg.exe 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\tshqnoalzzpfw.exe 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll hdhuzmlujd.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ezjavxlg.exe - Drops file in Program Files directory 22 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ezjavxlg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ezjavxlg.exe File created \??\c:\Program Files\SaveWrite.doc.exe ezjavxlg.exe File opened for modification \??\c:\Program Files\SaveWrite.doc.exe ezjavxlg.exe File opened for modification C:\Program Files\SaveWrite.nal ezjavxlg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ezjavxlg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ezjavxlg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ezjavxlg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ezjavxlg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ezjavxlg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ezjavxlg.exe File opened for modification C:\Program Files\SaveWrite.doc.exe ezjavxlg.exe File opened for modification C:\Program Files\SaveWrite.nal ezjavxlg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ezjavxlg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ezjavxlg.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ezjavxlg.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ezjavxlg.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ezjavxlg.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ezjavxlg.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ezjavxlg.exe File opened for modification \??\c:\Program Files\SaveWrite.doc.exe ezjavxlg.exe File opened for modification C:\Program Files\SaveWrite.doc.exe ezjavxlg.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe ezjavxlg.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe ezjavxlg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe ezjavxlg.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe ezjavxlg.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe ezjavxlg.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe ezjavxlg.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe ezjavxlg.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe ezjavxlg.exe File opened for modification C:\Windows\mydoc.rtf 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdhuzmlujd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpwzsomelpnuumi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ezjavxlg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tshqnoalzzpfw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ezjavxlg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf hdhuzmlujd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" hdhuzmlujd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" hdhuzmlujd.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33322C7C9C2182236D3676DD70532DDB7D8464DD" 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1938C6081596DBB1B9CE7CE1EC9437C8" 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh hdhuzmlujd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs hdhuzmlujd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AC8F9CBFE6AF29384083B3786963994B0FA038D4366023CE2CB42ED08A3" 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB7B02047E439E352C8B9A13299D7BE" 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat hdhuzmlujd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc hdhuzmlujd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" hdhuzmlujd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg hdhuzmlujd.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" hdhuzmlujd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" hdhuzmlujd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF5FCFF482882699136D7287D94BDE1E641583666476341D6EA" 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F36BB1FE1821ABD108D1D58A0C9117" 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" hdhuzmlujd.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 5608 WINWORD.EXE 5608 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe - Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3036 ezjavxlg.exe 3036 ezjavxlg.exe 3036 ezjavxlg.exe 5608 WINWORD.EXE 5608 WINWORD.EXE - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1480 hdhuzmlujd.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 1136 dpwzsomelpnuumi.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 4804 ezjavxlg.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3952 tshqnoalzzpfw.exe 3036 ezjavxlg.exe 3036 ezjavxlg.exe 3036 ezjavxlg.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5608 WINWORD.EXE 5608 WINWORD.EXE 5608 WINWORD.EXE 5608 WINWORD.EXE 5608 WINWORD.EXE 5608 WINWORD.EXE 5608 WINWORD.EXE 5608 WINWORD.EXE 5608 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1480 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 88 PID 1924 wrote to memory of 1136 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 89 PID 1924 wrote to memory of 4804 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 90 PID 1924 wrote to memory of 3952 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 91 PID 1480 wrote to memory of 3036 1480 hdhuzmlujd.exe 92 PID 1924 wrote to memory of 5608 1924 2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_d0a54a2ea47fe92c6bc28fbf1bad900c_elex_stop_yuner.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\hdhuzmlujd.exehdhuzmlujd.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\ezjavxlg.exeC:\Windows\system32\ezjavxlg.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3036
-
-
-
C:\Windows\SysWOW64\dpwzsomelpnuumi.exedpwzsomelpnuumi.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1136
-
-
C:\Windows\SysWOW64\ezjavxlg.exeezjavxlg.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4804
-
-
C:\Windows\SysWOW64\tshqnoalzzpfw.exetshqnoalzzpfw.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3952
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5608
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 512KB
- SHA256 6470d262097172b0a802e0b6af0fec0490ea787b1854b8a66b83b9c3c06faeeb
- MD5 94b3f9a395b8d3764b13ffa67b985a52
- SHA1 f4d317c61afe1983abb66383a9362cbba110f6cc
- SHA512 de78343bd913551b1ccfd2c0a40770a12923319e58119ec567dbf3f0c4554d5b9f76158d2e002be6d181de72aa2bf72a66beb726c00d1a818ba47ea56b2daa21
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m
- TLSH T12FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SaveWrite.doc.exe
- Size 512KB
- SHA256 77e611c0930e16cece6d4d4c5c83a8c2a3be9fa261b44569816c88650e902cdc
- MD5 21383f587cf1c9425e931df07cbf0667
- SHA1 be861e99271979301ef4ff0b076b9ee6917d923d
- SHA512 99ef052928a3c546a6ea31d337504c97f35a6400c1afc974bc9423d76d96fe3b59e7e47bc94fb03d9bdeb308c5b30b077499efab389f98ae6fcc256837850535
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj62:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5t
- TLSH T171B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 403B
- SHA256 f33199915a930c4c7e48a4bda8862d3cfd5b9316b2c954c1f82a8397219c64c2
- MD5 b8d81bb7ddc1f95dbd85637f0c01aa39
- SHA1 8a2570f877d2c93d66c4afa31d0a246b5ad407cf
- SHA512 8729224b54fbdc5d450277e2f5bd7f2891fa094641f137b4f0f8d72dcc5d1e970e409d30f08165c8ae9afaf0917a6a19ed74e2cbb0c9676b508c77e9a0895edb
- TLSH T1FFE01A9B9738EBF5E3BC81B538B99CE0EBF24848E76900300ACC4DD10D7198720EB249
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 5efb5bf0d78210f3a2173a6d56fd2469b902cf17807ec3ffd2ddfa5ffce4b0cd
- MD5 014af7d9a47066be9416b472b3c769df
- SHA1 31fc78374008786ddf871cd2a7e0e9e78ae2f1d8
- SHA512 eb966d49d2a75a0f3655a73d94227ab9a3c48ab450db54bc3b937d5580794748c5a6630cb5a437a45c47dee632a45416d222f17a498ff8d90f18f26d77c3c502
- TLSH T1A1511201D7AF2B5BD091D3324B2B4306DB747C43E614970DE644A53BAD34A61AF1DB2E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 4a6a210d26ceead93fc18356ca304409f9a6bc231efcb462f1b0ad5f9b8bca22
- MD5 b9938ae6079f4f4a8d6a10c037cd705a
- SHA1 4d18fec6ed923daee0d9d01e1997660191b1b948
- SHA512 f44d0e88fe30b12d4683ccb091ae740086de9b3c382aec962f32322f78663fc1ddd495d8e79887c22ef9921e54fe20958c98aba107250327f810637db4d1326f
- TLSH T1CB512101D7AF1B66D0A2D3324B2B4306EB747C03E714970DE644A537AE74A61AF1DB2E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\dpwzsomelpnuumi.exe
- Size 512KB
- SHA256 0dd00e690b20810e230d6c89d838ba9e3de23caf46165bf398cd6459a1165438
- MD5 49e36a345fc9760e3fba476f974ef4b6
- SHA1 87ae8b17d1507d64744da4a4e5be4ce3e6424ae3
- SHA512 fe878cf73ec1f6bb1159d61205deb8d58a09cd70a6228a508e3d6936245a28129e0f4995f8cf0486e86d70a1384ca41fab55acce53ef89f4dd90761b0bacd6b5
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5x
- TLSH T10AB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\ezjavxlg.exe
- Size 512KB
- SHA256 669bba6ab6d5479ae2b6fee595bbffaf70fbf24d7ed2fc0be09ee79c863a2ba1
- MD5 7cab4094cd79bdc4cd6e1ebb0604ddf9
- SHA1 80386d11079684aabd1f3c0b8c2d2413bcac212a
- SHA512 5572f81abda51a7419d34840042f9b06df099663db49446a7619e9796c88d8e133c91c5114b6ab0ce1ed805979327df482d4ac950f1c3898e3cdc31da8248643
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53
- TLSH T148B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\hdhuzmlujd.exe
- Size 512KB
- SHA256 892ba43bac6574bcdc7b7f01ad581e94091b599498f6a0c5b91fa7dcdc78c5bd
- MD5 a2b8b496ff635fad272967e5a1dcebca
- SHA1 3ef188be1216ab85dc7798cc8466322c2ccc432a
- SHA512 74998aa672b145dda2812543ec5da82317d1f566ee34a0456eceda47db08021b5055921d3efdd5c55913577425ed1b659ad231f63c5263d34fe253d0c678dac0
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5A
- TLSH T17FB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\tshqnoalzzpfw.exe
- Size 512KB
- SHA256 bd58b05c745c0f5519ee2ea3be5879cf7b7220f7c67e52f6788bce33c0f2c40e
- MD5 d1da859becae7cecf549f0bf9f6aa11a
- SHA1 37012b6789191595c6c1fe4def47adb8a85dbe88
- SHA512 e94e5497c5104c17249e2b9f76fd246d38004421324c5faf78b3301b8ebf2dbcf401a4b5ec3c3a9fc03e810dd42759650e887af2ba14defe5a8277e2dcc20748
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o
- TLSH T1EEB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\Desktop\SwitchSubmit.doc.exe
- Size 512KB
- SHA256 a3c914e0eaff13a5af9903942877e451a1d0613616f801fc34240a0b4a233fd9
- MD5 5b134d070803bea8b78b60d961ae7af9
- SHA1 8beeaf211c57d3ba62eea0ec109d742e793a3732
- SHA512 b37ff544125f7b0c4f8f21ccca9c7562852d8a22db3073391deb2fc51d464cbfaf44731acba5dba30843250939e3e338dae57d6f21c707064d476e0ded1e818f
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6o:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5r
- TLSH T1B5B4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 165c5f6b60f3a2fbfc044fe1cbbe11f23e31833bcb1b3bdc9c9beccf3aab09de
- MD5 8503a9fe5ec8d390543f80b6aa6ca6e5
- SHA1 dfff3ef30af675578ceb73392d6851b6ae9b7b99
- SHA512 9b8ad6408415de59936c51491f12e69151c342bf7cdbbdd195e2cb9b8ccced2d28f76ca2d39ad5e0d6899b47e9ea0ec3d202587d9403fe7171b2498440f9bdc1
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C
- TLSH T15CB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 512KB
- SHA256 31eea1878e7661aa2a35efa5ac40131aaa42213025421bf89a8a64ab77429d1e
- MD5 17f9c8498d56cd25f6a221e345813e98
- SHA1 24a45965d4edbf2ce51782f6305fc31da69c37f9
- SHA512 84bf65ca274d7591c092f17e3f033fe7599ac2f0634880f01b657ac416f4a979cddca4cb045b363c6ebdec8ac22b6609ff00fb531b1facb8ed894a049fc3294b
- SSDEEP 6144:5VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6O:5gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5F
- TLSH T1CDB4AE2276E1B0B2E96325F00F76D728E777BC3456359447A7C02E8BAA30951973B363
- MD5 SHA1 SHA512 SSDEEP TLSH