ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5

Analysis

max time kernel
152s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
Size

255KB
MD5

626509ddae151d48789e02639aac4d60
SHA1

af14c973814bd987d8f2c8d62c39308c68dc2878
SHA256

ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5
SHA512

9f54a6e2ff181c0c093204d6183b23cd4919d91e10cc0d786cd214e0cf9f698043b64b1ee73870dedd8788ecbb2fb792fce257a5a50bffe28b580e1dba5e5d25
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI4

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	pjbseccxqo.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	pjbseccxqo.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	pjbseccxqo.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pjbseccxqo.exe

Executes dropped EXE 6 IoCs

pid	Process
1540	pjbseccxqo.exe
1028	nnjlxnauwnqitnl.exe
584	eclgnelm.exe
516	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
1636	eclgnelm.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000005c51-55.dat	upx
behavioral1/files/0x0008000000005c51-57.dat	upx
behavioral1/files/0x00080000000142c0-58.dat	upx
behavioral1/files/0x00080000000142c0-61.dat	upx
behavioral1/files/0x000700000001448d-63.dat	upx
behavioral1/files/0x00060000000144ba-71.dat	upx
behavioral1/files/0x00060000000144ba-69.dat	upx
behavioral1/files/0x0008000000005c51-68.dat	upx
behavioral1/files/0x00080000000142c0-64.dat	upx
behavioral1/files/0x000700000001448d-66.dat	upx
behavioral1/files/0x000700000001448d-74.dat	upx
behavioral1/files/0x00060000000144ba-73.dat	upx
behavioral1/memory/1540-78-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1672-76-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1028-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/584-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00060000000144ba-81.dat	upx
behavioral1/memory/516-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00060000000144ba-85.dat	upx
behavioral1/files/0x000700000001448d-87.dat	upx
behavioral1/files/0x000700000001448d-89.dat	upx
behavioral1/memory/1672-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1636-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/824-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x000600000001560c-101.dat	upx
behavioral1/files/0x0006000000015648-102.dat	upx
behavioral1/files/0x0006000000015c07-103.dat	upx
behavioral1/memory/584-104-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1540-105-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1028-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/516-107-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/824-108-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1636-109-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1636-113-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/584-114-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
856	cmd.exe
1540	pjbseccxqo.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	pjbseccxqo.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gzquehfi = "nnjlxnauwnqitnl.exe"	nnjlxnauwnqitnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tjvoigoixjtsi.exe"	nnjlxnauwnqitnl.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	nnjlxnauwnqitnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yhsmcqeh = "pjbseccxqo.exe"	nnjlxnauwnqitnl.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	eclgnelm.exe
File opened (read-only)	\??\r:	pjbseccxqo.exe
File opened (read-only)	\??\s:	pjbseccxqo.exe
File opened (read-only)	\??\h:	eclgnelm.exe
File opened (read-only)	\??\w:	eclgnelm.exe
File opened (read-only)	\??\h:	pjbseccxqo.exe
File opened (read-only)	\??\j:	pjbseccxqo.exe
File opened (read-only)	\??\k:	pjbseccxqo.exe
File opened (read-only)	\??\p:	eclgnelm.exe
File opened (read-only)	\??\r:	eclgnelm.exe
File opened (read-only)	\??\v:	eclgnelm.exe
File opened (read-only)	\??\o:	eclgnelm.exe
File opened (read-only)	\??\q:	eclgnelm.exe
File opened (read-only)	\??\e:	pjbseccxqo.exe
File opened (read-only)	\??\f:	pjbseccxqo.exe
File opened (read-only)	\??\m:	pjbseccxqo.exe
File opened (read-only)	\??\q:	pjbseccxqo.exe
File opened (read-only)	\??\e:	eclgnelm.exe
File opened (read-only)	\??\y:	eclgnelm.exe
File opened (read-only)	\??\w:	pjbseccxqo.exe
File opened (read-only)	\??\s:	eclgnelm.exe
File opened (read-only)	\??\h:	eclgnelm.exe
File opened (read-only)	\??\k:	eclgnelm.exe
File opened (read-only)	\??\p:	pjbseccxqo.exe
File opened (read-only)	\??\m:	eclgnelm.exe
File opened (read-only)	\??\r:	eclgnelm.exe
File opened (read-only)	\??\u:	eclgnelm.exe
File opened (read-only)	\??\v:	eclgnelm.exe
File opened (read-only)	\??\a:	pjbseccxqo.exe
File opened (read-only)	\??\z:	eclgnelm.exe
File opened (read-only)	\??\i:	eclgnelm.exe
File opened (read-only)	\??\t:	eclgnelm.exe
File opened (read-only)	\??\k:	eclgnelm.exe
File opened (read-only)	\??\l:	eclgnelm.exe
File opened (read-only)	\??\q:	eclgnelm.exe
File opened (read-only)	\??\b:	eclgnelm.exe
File opened (read-only)	\??\s:	eclgnelm.exe
File opened (read-only)	\??\z:	eclgnelm.exe
File opened (read-only)	\??\l:	pjbseccxqo.exe
File opened (read-only)	\??\b:	eclgnelm.exe
File opened (read-only)	\??\f:	eclgnelm.exe
File opened (read-only)	\??\u:	eclgnelm.exe
File opened (read-only)	\??\g:	eclgnelm.exe
File opened (read-only)	\??\g:	pjbseccxqo.exe
File opened (read-only)	\??\i:	pjbseccxqo.exe
File opened (read-only)	\??\t:	pjbseccxqo.exe
File opened (read-only)	\??\z:	pjbseccxqo.exe
File opened (read-only)	\??\o:	eclgnelm.exe
File opened (read-only)	\??\t:	eclgnelm.exe
File opened (read-only)	\??\n:	eclgnelm.exe
File opened (read-only)	\??\y:	pjbseccxqo.exe
File opened (read-only)	\??\j:	eclgnelm.exe
File opened (read-only)	\??\a:	eclgnelm.exe
File opened (read-only)	\??\x:	eclgnelm.exe
File opened (read-only)	\??\x:	pjbseccxqo.exe
File opened (read-only)	\??\w:	eclgnelm.exe
File opened (read-only)	\??\a:	eclgnelm.exe
File opened (read-only)	\??\n:	eclgnelm.exe
File opened (read-only)	\??\x:	eclgnelm.exe
File opened (read-only)	\??\l:	eclgnelm.exe
File opened (read-only)	\??\p:	eclgnelm.exe
File opened (read-only)	\??\o:	pjbseccxqo.exe
File opened (read-only)	\??\y:	eclgnelm.exe
File opened (read-only)	\??\f:	eclgnelm.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	pjbseccxqo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	pjbseccxqo.exe

AutoIT Executable 17 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1540-78-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1672-76-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1028-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/584-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1672-82-0x0000000002EE0000-0x0000000002F80000-memory.dmp	autoit_exe
behavioral1/memory/516-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1672-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1636-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/824-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/584-104-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1540-105-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1028-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/516-107-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/824-108-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1636-109-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1636-113-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/584-114-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eclgnelm.exe	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
File opened for modification	C:\Windows\SysWOW64\eclgnelm.exe	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
File created	C:\Windows\SysWOW64\tjvoigoixjtsi.exe	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
File created	C:\Windows\SysWOW64\pjbseccxqo.exe	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
File created	C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
File opened for modification	C:\Windows\SysWOW64\tjvoigoixjtsi.exe	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	pjbseccxqo.exe
File opened for modification	C:\Windows\SysWOW64\pjbseccxqo.exe	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
File opened for modification	C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eclgnelm.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eclgnelm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eclgnelm.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eclgnelm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	eclgnelm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	eclgnelm.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eclgnelm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	eclgnelm.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eclgnelm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eclgnelm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	eclgnelm.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eclgnelm.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eclgnelm.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eclgnelm.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0816BC4FF6721ACD273D1D68A7C9162"	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	pjbseccxqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	pjbseccxqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	pjbseccxqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1964	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1028	nnjlxnauwnqitnl.exe
1028	nnjlxnauwnqitnl.exe
1028	nnjlxnauwnqitnl.exe
1028	nnjlxnauwnqitnl.exe
1028	nnjlxnauwnqitnl.exe
1540	pjbseccxqo.exe
1540	pjbseccxqo.exe
1540	pjbseccxqo.exe
1540	pjbseccxqo.exe
1540	pjbseccxqo.exe
584	eclgnelm.exe
584	eclgnelm.exe
584	eclgnelm.exe
584	eclgnelm.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
1028	nnjlxnauwnqitnl.exe
1636	eclgnelm.exe
1636	eclgnelm.exe
1636	eclgnelm.exe
1636	eclgnelm.exe
1028	nnjlxnauwnqitnl.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
1028	nnjlxnauwnqitnl.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
1028	nnjlxnauwnqitnl.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
1028	nnjlxnauwnqitnl.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
1028	nnjlxnauwnqitnl.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
1028	nnjlxnauwnqitnl.exe
824	tjvoigoixjtsi.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1028	nnjlxnauwnqitnl.exe
1028	nnjlxnauwnqitnl.exe
1028	nnjlxnauwnqitnl.exe
1540	pjbseccxqo.exe
1540	pjbseccxqo.exe
1540	pjbseccxqo.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
584	eclgnelm.exe
584	eclgnelm.exe
584	eclgnelm.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
1636	eclgnelm.exe
1636	eclgnelm.exe
1636	eclgnelm.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
1028	nnjlxnauwnqitnl.exe
1028	nnjlxnauwnqitnl.exe
1028	nnjlxnauwnqitnl.exe
1540	pjbseccxqo.exe
1540	pjbseccxqo.exe
1540	pjbseccxqo.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
516	tjvoigoixjtsi.exe
584	eclgnelm.exe
584	eclgnelm.exe
584	eclgnelm.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
824	tjvoigoixjtsi.exe
1636	eclgnelm.exe
1636	eclgnelm.exe
1636	eclgnelm.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1964	WINWORD.EXE
1964	WINWORD.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1540	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	27
PID 1672 wrote to memory of 1540	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	27
PID 1672 wrote to memory of 1540	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	27
PID 1672 wrote to memory of 1540	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	27
PID 1672 wrote to memory of 1028	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	28
PID 1672 wrote to memory of 1028	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	28
PID 1672 wrote to memory of 1028	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	28
PID 1672 wrote to memory of 1028	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	28
PID 1672 wrote to memory of 584	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	29
PID 1672 wrote to memory of 584	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	29
PID 1672 wrote to memory of 584	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	29
PID 1672 wrote to memory of 584	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	29
PID 1672 wrote to memory of 516	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	30
PID 1672 wrote to memory of 516	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	30
PID 1672 wrote to memory of 516	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	30
PID 1672 wrote to memory of 516	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	30
PID 1028 wrote to memory of 856	1028	nnjlxnauwnqitnl.exe	31
PID 1028 wrote to memory of 856	1028	nnjlxnauwnqitnl.exe	31
PID 1028 wrote to memory of 856	1028	nnjlxnauwnqitnl.exe	31
PID 1028 wrote to memory of 856	1028	nnjlxnauwnqitnl.exe	31
PID 856 wrote to memory of 824	856	cmd.exe	33
PID 856 wrote to memory of 824	856	cmd.exe	33
PID 856 wrote to memory of 824	856	cmd.exe	33
PID 856 wrote to memory of 824	856	cmd.exe	33
PID 1540 wrote to memory of 1636	1540	pjbseccxqo.exe	34
PID 1540 wrote to memory of 1636	1540	pjbseccxqo.exe	34
PID 1540 wrote to memory of 1636	1540	pjbseccxqo.exe	34
PID 1540 wrote to memory of 1636	1540	pjbseccxqo.exe	34
PID 1672 wrote to memory of 1964	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	35
PID 1672 wrote to memory of 1964	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	35
PID 1672 wrote to memory of 1964	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	35
PID 1672 wrote to memory of 1964	1672	ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe	35
PID 1964 wrote to memory of 1696	1964	WINWORD.EXE	39
PID 1964 wrote to memory of 1696	1964	WINWORD.EXE	39
PID 1964 wrote to memory of 1696	1964	WINWORD.EXE	39
PID 1964 wrote to memory of 1696	1964	WINWORD.EXE	39

C:\Users\Admin\AppData\Local\Temp\ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
"C:\Users\Admin\AppData\Local\Temp\ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\pjbseccxqo.exe
  pjbseccxqo.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\eclgnelm.exe
    C:\Windows\system32\eclgnelm.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1636
- C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe
  nnjlxnauwnqitnl.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c tjvoigoixjtsi.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\Windows\SysWOW64\tjvoigoixjtsi.exe
      tjvoigoixjtsi.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:824
- C:\Windows\SysWOW64\eclgnelm.exe
  eclgnelm.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:584
- C:\Windows\SysWOW64\tjvoigoixjtsi.exe
  tjvoigoixjtsi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:516
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
256KB

MD5
81c876c317f8b2da6d461b47bbb22e49

SHA1
92c943ad9f427cdf08b648baf698dcaee3b6bc49

SHA256
f58d99ca76a224b810d20b35cf909f6a89152b404f55559e99436587f7c1b7c7

SHA512
b90af41526d6c38c9fcee5c1e5a2bba996acc82853e1f03df01f500376599e6e8401cd56488eba0ebbe6111a27ec74e1a625f6fb2995f31ef8cc6db860a51d03

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
256KB

MD5
75d3a4e2f7c32aa7b70f842101bbccf0

SHA1
ccd544097b62278b8968312ad0349dda38d9eb65

SHA256
0dc0b656e5529bde74a03d3b533cdffbb315e61d07091c3d2c731a60af824ae2

SHA512
a7613ce87aaaab6227e795f4e792cf4702efcaae09c09c32ddf697fe5893dfa451e535670ca2ad79ca62ac4ff18c365ae8edfc53de32c7c4e50a8e96b72985ad

Download Submit
C:\Users\Admin\Music\PublishWatch.doc.exe

Filesize
256KB

MD5
02ead720413f475af3103c06d42e70aa

SHA1
a812e6a4c6bff94970b195d1ebc890b3b0306276

SHA256
a6e8c1bc259d9dab73baa6b4bbd0cb2131927b98d1593ff78fc4bddca97e3133

SHA512
e17b010f7c5fb944212885f6cab8b87be5203124a33abec925b0e0c294d2f9cf761be847b5fa04d3763b25fff0bc5863f5361aa39210262992900fede49302f6

Download Submit
C:\Windows\SysWOW64\eclgnelm.exe

Filesize
255KB

MD5
dd5045eef78d00648ddcf9f4e72e9325

SHA1
e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

SHA256
8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

SHA512
e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

Download Submit
C:\Windows\SysWOW64\eclgnelm.exe

Filesize
255KB

MD5
dd5045eef78d00648ddcf9f4e72e9325

SHA1
e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

SHA256
8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

SHA512
e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

Download Submit
C:\Windows\SysWOW64\eclgnelm.exe

Filesize
255KB

MD5
dd5045eef78d00648ddcf9f4e72e9325

SHA1
e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

SHA256
8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

SHA512
e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

Download Submit
C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe

Filesize
255KB

MD5
41aa06bb457b1221c88d42467916aee6

SHA1
eae4771749505dfa127b562160a0a33c03d78823

SHA256
e96a756a2d504b5032d2b8a625ee448bb982f0fe8ac887d37a90c1a2116e949d

SHA512
d61b8df3cf1ccf15ca57b226c1a474342dfbd43b159a10fcac6905fceafad8ac6824178f9f6b0b145c1aa22726b04dcfe96df8f91e3c26435f9ed70c2bd561e1

Download Submit
C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe

Filesize
255KB

MD5
41aa06bb457b1221c88d42467916aee6

SHA1
eae4771749505dfa127b562160a0a33c03d78823

SHA256
e96a756a2d504b5032d2b8a625ee448bb982f0fe8ac887d37a90c1a2116e949d

SHA512
d61b8df3cf1ccf15ca57b226c1a474342dfbd43b159a10fcac6905fceafad8ac6824178f9f6b0b145c1aa22726b04dcfe96df8f91e3c26435f9ed70c2bd561e1

Download Submit
C:\Windows\SysWOW64\pjbseccxqo.exe

Filesize
255KB

MD5
2f17221bf5cd7aeefb796fe4f297612c

SHA1
c52256ca97ebf96c2df976b72073a18c0392b468

SHA256
1313a8910bf9a96d156d736f7402b3b2e13ec10133a58c116e680630af15932b

SHA512
ea2f975d9f11dbdff6597516d2edb1bdff71892e13dd5fe8867b2e08297c5ee0ecf3ffa818775b2587759fd1cc9de24ab44deef631547cc54fd5aa68e479a5db

Download Submit
C:\Windows\SysWOW64\pjbseccxqo.exe

Filesize
255KB

MD5
2f17221bf5cd7aeefb796fe4f297612c

SHA1
c52256ca97ebf96c2df976b72073a18c0392b468

SHA256
1313a8910bf9a96d156d736f7402b3b2e13ec10133a58c116e680630af15932b

SHA512
ea2f975d9f11dbdff6597516d2edb1bdff71892e13dd5fe8867b2e08297c5ee0ecf3ffa818775b2587759fd1cc9de24ab44deef631547cc54fd5aa68e479a5db

Download Submit
C:\Windows\SysWOW64\tjvoigoixjtsi.exe

Filesize
255KB

MD5
1c30632be1902da43e5518436e219ff9

SHA1
bdda0c10ae20d61282390570ee4e7aab98214ae2

SHA256
8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

SHA512
77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

Download Submit
C:\Windows\SysWOW64\tjvoigoixjtsi.exe

Filesize
255KB

MD5
1c30632be1902da43e5518436e219ff9

SHA1
bdda0c10ae20d61282390570ee4e7aab98214ae2

SHA256
8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

SHA512
77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

Download Submit
C:\Windows\SysWOW64\tjvoigoixjtsi.exe

Filesize
255KB

MD5
1c30632be1902da43e5518436e219ff9

SHA1
bdda0c10ae20d61282390570ee4e7aab98214ae2

SHA256
8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

SHA512
77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\eclgnelm.exe

Filesize
255KB

MD5
dd5045eef78d00648ddcf9f4e72e9325

SHA1
e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

SHA256
8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

SHA512
e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

Download Submit
\Windows\SysWOW64\eclgnelm.exe

Filesize
255KB

MD5
dd5045eef78d00648ddcf9f4e72e9325

SHA1
e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a

SHA256
8e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02

SHA512
e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b

Download Submit
\Windows\SysWOW64\nnjlxnauwnqitnl.exe

Filesize
255KB

MD5
41aa06bb457b1221c88d42467916aee6

SHA1
eae4771749505dfa127b562160a0a33c03d78823

SHA256
e96a756a2d504b5032d2b8a625ee448bb982f0fe8ac887d37a90c1a2116e949d

SHA512
d61b8df3cf1ccf15ca57b226c1a474342dfbd43b159a10fcac6905fceafad8ac6824178f9f6b0b145c1aa22726b04dcfe96df8f91e3c26435f9ed70c2bd561e1

Download Submit
\Windows\SysWOW64\pjbseccxqo.exe

Filesize
255KB

MD5
2f17221bf5cd7aeefb796fe4f297612c

SHA1
c52256ca97ebf96c2df976b72073a18c0392b468

SHA256
1313a8910bf9a96d156d736f7402b3b2e13ec10133a58c116e680630af15932b

SHA512
ea2f975d9f11dbdff6597516d2edb1bdff71892e13dd5fe8867b2e08297c5ee0ecf3ffa818775b2587759fd1cc9de24ab44deef631547cc54fd5aa68e479a5db

Download Submit
\Windows\SysWOW64\tjvoigoixjtsi.exe

Filesize
255KB

MD5
1c30632be1902da43e5518436e219ff9

SHA1
bdda0c10ae20d61282390570ee4e7aab98214ae2

SHA256
8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

SHA512
77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

Download Submit
\Windows\SysWOW64\tjvoigoixjtsi.exe

Filesize
255KB

MD5
1c30632be1902da43e5518436e219ff9

SHA1
bdda0c10ae20d61282390570ee4e7aab98214ae2

SHA256
8ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3

SHA512
77802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244

Download Submit
memory/516-107-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/516-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/584-114-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/584-104-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/584-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/824-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/824-108-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1028-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1028-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1540-78-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1540-105-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1636-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1636-109-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1636-113-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1672-77-0x0000000002EE0000-0x0000000002F80000-memory.dmp

Filesize
640KB

Download
memory/1672-82-0x0000000002EE0000-0x0000000002F80000-memory.dmp

Filesize
640KB

Download
memory/1672-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1672-76-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1696-112-0x000007FEFB7F1000-0x000007FEFB7F3000-memory.dmp

Filesize
8KB

Download
memory/1964-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1964-110-0x0000000070BAD000-0x0000000070BB8000-memory.dmp

Filesize
44KB

Download
memory/1964-100-0x0000000070BAD000-0x0000000070BB8000-memory.dmp

Filesize
44KB

Download
memory/1964-94-0x000000006FBC1000-0x000000006FBC3000-memory.dmp

Filesize
8KB

Download
memory/1964-93-0x0000000072141000-0x0000000072144000-memory.dmp

Filesize
12KB

Download
memory/1964-115-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1964-116-0x0000000070BAD000-0x0000000070BB8000-memory.dmp

Filesize
44KB

Download