Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 16:56
Behavioral task
behavioral1
Sample
ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
Resource
win7-20220901-en
General
-
Target
ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe
-
Size
255KB
-
MD5
626509ddae151d48789e02639aac4d60
-
SHA1
af14c973814bd987d8f2c8d62c39308c68dc2878
-
SHA256
ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5
-
SHA512
9f54a6e2ff181c0c093204d6183b23cd4919d91e10cc0d786cd214e0cf9f698043b64b1ee73870dedd8788ecbb2fb792fce257a5a50bffe28b580e1dba5e5d25
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI4
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" pjbseccxqo.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pjbseccxqo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" pjbseccxqo.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" pjbseccxqo.exe -
Executes dropped EXE 6 IoCs
pid Process 1540 pjbseccxqo.exe 1028 nnjlxnauwnqitnl.exe 584 eclgnelm.exe 516 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 1636 eclgnelm.exe -
resource yara_rule behavioral1/files/0x0008000000005c51-55.dat upx behavioral1/files/0x0008000000005c51-57.dat upx behavioral1/files/0x00080000000142c0-58.dat upx behavioral1/files/0x00080000000142c0-61.dat upx behavioral1/files/0x000700000001448d-63.dat upx behavioral1/files/0x00060000000144ba-71.dat upx behavioral1/files/0x00060000000144ba-69.dat upx behavioral1/files/0x0008000000005c51-68.dat upx behavioral1/files/0x00080000000142c0-64.dat upx behavioral1/files/0x000700000001448d-66.dat upx behavioral1/files/0x000700000001448d-74.dat upx behavioral1/files/0x00060000000144ba-73.dat upx behavioral1/memory/1540-78-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1672-76-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1028-79-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/584-80-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x00060000000144ba-81.dat upx behavioral1/memory/516-84-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x00060000000144ba-85.dat upx behavioral1/files/0x000700000001448d-87.dat upx behavioral1/files/0x000700000001448d-89.dat upx behavioral1/memory/1672-92-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1636-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/824-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/files/0x000600000001560c-101.dat upx behavioral1/files/0x0006000000015648-102.dat upx behavioral1/files/0x0006000000015c07-103.dat upx behavioral1/memory/584-104-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1540-105-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1028-106-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/516-107-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/824-108-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1636-109-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1636-113-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/584-114-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Loads dropped DLL 6 IoCs
pid Process 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 856 cmd.exe 1540 pjbseccxqo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pjbseccxqo.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gzquehfi = "nnjlxnauwnqitnl.exe" nnjlxnauwnqitnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tjvoigoixjtsi.exe" nnjlxnauwnqitnl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run nnjlxnauwnqitnl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yhsmcqeh = "pjbseccxqo.exe" nnjlxnauwnqitnl.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: eclgnelm.exe File opened (read-only) \??\r: pjbseccxqo.exe File opened (read-only) \??\s: pjbseccxqo.exe File opened (read-only) \??\h: eclgnelm.exe File opened (read-only) \??\w: eclgnelm.exe File opened (read-only) \??\h: pjbseccxqo.exe File opened (read-only) \??\j: pjbseccxqo.exe File opened (read-only) \??\k: pjbseccxqo.exe File opened (read-only) \??\p: eclgnelm.exe File opened (read-only) \??\r: eclgnelm.exe File opened (read-only) \??\v: eclgnelm.exe File opened (read-only) \??\o: eclgnelm.exe File opened (read-only) \??\q: eclgnelm.exe File opened (read-only) \??\e: pjbseccxqo.exe File opened (read-only) \??\f: pjbseccxqo.exe File opened (read-only) \??\m: pjbseccxqo.exe File opened (read-only) \??\q: pjbseccxqo.exe File opened (read-only) \??\e: eclgnelm.exe File opened (read-only) \??\y: eclgnelm.exe File opened (read-only) \??\w: pjbseccxqo.exe File opened (read-only) \??\s: eclgnelm.exe File opened (read-only) \??\h: eclgnelm.exe File opened (read-only) \??\k: eclgnelm.exe File opened (read-only) \??\p: pjbseccxqo.exe File opened (read-only) \??\m: eclgnelm.exe File opened (read-only) \??\r: eclgnelm.exe File opened (read-only) \??\u: eclgnelm.exe File opened (read-only) \??\v: eclgnelm.exe File opened (read-only) \??\a: pjbseccxqo.exe File opened (read-only) \??\z: eclgnelm.exe File opened (read-only) \??\i: eclgnelm.exe File opened (read-only) \??\t: eclgnelm.exe File opened (read-only) \??\k: eclgnelm.exe File opened (read-only) \??\l: eclgnelm.exe File opened (read-only) \??\q: eclgnelm.exe File opened (read-only) \??\b: eclgnelm.exe File opened (read-only) \??\s: eclgnelm.exe File opened (read-only) \??\z: eclgnelm.exe File opened (read-only) \??\l: pjbseccxqo.exe File opened (read-only) \??\b: eclgnelm.exe File opened (read-only) \??\f: eclgnelm.exe File opened (read-only) \??\u: eclgnelm.exe File opened (read-only) \??\g: eclgnelm.exe File opened (read-only) \??\g: pjbseccxqo.exe File opened (read-only) \??\i: pjbseccxqo.exe File opened (read-only) \??\t: pjbseccxqo.exe File opened (read-only) \??\z: pjbseccxqo.exe File opened (read-only) \??\o: eclgnelm.exe File opened (read-only) \??\t: eclgnelm.exe File opened (read-only) \??\n: eclgnelm.exe File opened (read-only) \??\y: pjbseccxqo.exe File opened (read-only) \??\j: eclgnelm.exe File opened (read-only) \??\a: eclgnelm.exe File opened (read-only) \??\x: eclgnelm.exe File opened (read-only) \??\x: pjbseccxqo.exe File opened (read-only) \??\w: eclgnelm.exe File opened (read-only) \??\a: eclgnelm.exe File opened (read-only) \??\n: eclgnelm.exe File opened (read-only) \??\x: eclgnelm.exe File opened (read-only) \??\l: eclgnelm.exe File opened (read-only) \??\p: eclgnelm.exe File opened (read-only) \??\o: pjbseccxqo.exe File opened (read-only) \??\y: eclgnelm.exe File opened (read-only) \??\f: eclgnelm.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" pjbseccxqo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" pjbseccxqo.exe -
AutoIT Executable 17 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1540-78-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1672-76-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1028-79-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/584-80-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1672-82-0x0000000002EE0000-0x0000000002F80000-memory.dmp autoit_exe behavioral1/memory/516-84-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1672-92-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1636-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/824-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/584-104-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1540-105-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1028-106-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/516-107-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/824-108-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1636-109-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1636-113-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/584-114-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\eclgnelm.exe ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe File opened for modification C:\Windows\SysWOW64\eclgnelm.exe ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe File created C:\Windows\SysWOW64\tjvoigoixjtsi.exe ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe File created C:\Windows\SysWOW64\pjbseccxqo.exe ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe File created C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe File opened for modification C:\Windows\SysWOW64\tjvoigoixjtsi.exe ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll pjbseccxqo.exe File opened for modification C:\Windows\SysWOW64\pjbseccxqo.exe ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe File opened for modification C:\Windows\SysWOW64\nnjlxnauwnqitnl.exe ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eclgnelm.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eclgnelm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eclgnelm.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eclgnelm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal eclgnelm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal eclgnelm.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eclgnelm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal eclgnelm.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eclgnelm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe eclgnelm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal eclgnelm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eclgnelm.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eclgnelm.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe eclgnelm.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0816BC4FF6721ACD273D1D68A7C9162" ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" pjbseccxqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" pjbseccxqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" pjbseccxqo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1964 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1028 nnjlxnauwnqitnl.exe 1028 nnjlxnauwnqitnl.exe 1028 nnjlxnauwnqitnl.exe 1028 nnjlxnauwnqitnl.exe 1028 nnjlxnauwnqitnl.exe 1540 pjbseccxqo.exe 1540 pjbseccxqo.exe 1540 pjbseccxqo.exe 1540 pjbseccxqo.exe 1540 pjbseccxqo.exe 584 eclgnelm.exe 584 eclgnelm.exe 584 eclgnelm.exe 584 eclgnelm.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 1028 nnjlxnauwnqitnl.exe 1636 eclgnelm.exe 1636 eclgnelm.exe 1636 eclgnelm.exe 1636 eclgnelm.exe 1028 nnjlxnauwnqitnl.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 1028 nnjlxnauwnqitnl.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 1028 nnjlxnauwnqitnl.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 1028 nnjlxnauwnqitnl.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 1028 nnjlxnauwnqitnl.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 1028 nnjlxnauwnqitnl.exe 824 tjvoigoixjtsi.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
pid Process 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1028 nnjlxnauwnqitnl.exe 1028 nnjlxnauwnqitnl.exe 1028 nnjlxnauwnqitnl.exe 1540 pjbseccxqo.exe 1540 pjbseccxqo.exe 1540 pjbseccxqo.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 584 eclgnelm.exe 584 eclgnelm.exe 584 eclgnelm.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 1636 eclgnelm.exe 1636 eclgnelm.exe 1636 eclgnelm.exe -
Suspicious use of SendNotifyMessage 21 IoCs
pid Process 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 1028 nnjlxnauwnqitnl.exe 1028 nnjlxnauwnqitnl.exe 1028 nnjlxnauwnqitnl.exe 1540 pjbseccxqo.exe 1540 pjbseccxqo.exe 1540 pjbseccxqo.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 516 tjvoigoixjtsi.exe 584 eclgnelm.exe 584 eclgnelm.exe 584 eclgnelm.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 824 tjvoigoixjtsi.exe 1636 eclgnelm.exe 1636 eclgnelm.exe 1636 eclgnelm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1964 WINWORD.EXE 1964 WINWORD.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1540 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 27 PID 1672 wrote to memory of 1540 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 27 PID 1672 wrote to memory of 1540 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 27 PID 1672 wrote to memory of 1540 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 27 PID 1672 wrote to memory of 1028 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 28 PID 1672 wrote to memory of 1028 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 28 PID 1672 wrote to memory of 1028 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 28 PID 1672 wrote to memory of 1028 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 28 PID 1672 wrote to memory of 584 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 29 PID 1672 wrote to memory of 584 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 29 PID 1672 wrote to memory of 584 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 29 PID 1672 wrote to memory of 584 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 29 PID 1672 wrote to memory of 516 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 30 PID 1672 wrote to memory of 516 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 30 PID 1672 wrote to memory of 516 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 30 PID 1672 wrote to memory of 516 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 30 PID 1028 wrote to memory of 856 1028 nnjlxnauwnqitnl.exe 31 PID 1028 wrote to memory of 856 1028 nnjlxnauwnqitnl.exe 31 PID 1028 wrote to memory of 856 1028 nnjlxnauwnqitnl.exe 31 PID 1028 wrote to memory of 856 1028 nnjlxnauwnqitnl.exe 31 PID 856 wrote to memory of 824 856 cmd.exe 33 PID 856 wrote to memory of 824 856 cmd.exe 33 PID 856 wrote to memory of 824 856 cmd.exe 33 PID 856 wrote to memory of 824 856 cmd.exe 33 PID 1540 wrote to memory of 1636 1540 pjbseccxqo.exe 34 PID 1540 wrote to memory of 1636 1540 pjbseccxqo.exe 34 PID 1540 wrote to memory of 1636 1540 pjbseccxqo.exe 34 PID 1540 wrote to memory of 1636 1540 pjbseccxqo.exe 34 PID 1672 wrote to memory of 1964 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 35 PID 1672 wrote to memory of 1964 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 35 PID 1672 wrote to memory of 1964 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 35 PID 1672 wrote to memory of 1964 1672 ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe 35 PID 1964 wrote to memory of 1696 1964 WINWORD.EXE 39 PID 1964 wrote to memory of 1696 1964 WINWORD.EXE 39 PID 1964 wrote to memory of 1696 1964 WINWORD.EXE 39 PID 1964 wrote to memory of 1696 1964 WINWORD.EXE 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe"C:\Users\Admin\AppData\Local\Temp\ec036499f9b63c373e12161b7450cb73bc820813780a398cb0e0a8ff0df599d5.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\pjbseccxqo.exepjbseccxqo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\eclgnelm.exeC:\Windows\system32\eclgnelm.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1636
-
-
-
C:\Windows\SysWOW64\nnjlxnauwnqitnl.exennjlxnauwnqitnl.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cmd.execmd.exe /c tjvoigoixjtsi.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\tjvoigoixjtsi.exetjvoigoixjtsi.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:824
-
-
-
-
C:\Windows\SysWOW64\eclgnelm.exeeclgnelm.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:584
-
-
C:\Windows\SysWOW64\tjvoigoixjtsi.exetjvoigoixjtsi.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:516
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1696
-
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD581c876c317f8b2da6d461b47bbb22e49
SHA192c943ad9f427cdf08b648baf698dcaee3b6bc49
SHA256f58d99ca76a224b810d20b35cf909f6a89152b404f55559e99436587f7c1b7c7
SHA512b90af41526d6c38c9fcee5c1e5a2bba996acc82853e1f03df01f500376599e6e8401cd56488eba0ebbe6111a27ec74e1a625f6fb2995f31ef8cc6db860a51d03
-
Filesize
256KB
MD575d3a4e2f7c32aa7b70f842101bbccf0
SHA1ccd544097b62278b8968312ad0349dda38d9eb65
SHA2560dc0b656e5529bde74a03d3b533cdffbb315e61d07091c3d2c731a60af824ae2
SHA512a7613ce87aaaab6227e795f4e792cf4702efcaae09c09c32ddf697fe5893dfa451e535670ca2ad79ca62ac4ff18c365ae8edfc53de32c7c4e50a8e96b72985ad
-
Filesize
256KB
MD502ead720413f475af3103c06d42e70aa
SHA1a812e6a4c6bff94970b195d1ebc890b3b0306276
SHA256a6e8c1bc259d9dab73baa6b4bbd0cb2131927b98d1593ff78fc4bddca97e3133
SHA512e17b010f7c5fb944212885f6cab8b87be5203124a33abec925b0e0c294d2f9cf761be847b5fa04d3763b25fff0bc5863f5361aa39210262992900fede49302f6
-
Filesize
255KB
MD5dd5045eef78d00648ddcf9f4e72e9325
SHA1e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a
SHA2568e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02
SHA512e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b
-
Filesize
255KB
MD5dd5045eef78d00648ddcf9f4e72e9325
SHA1e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a
SHA2568e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02
SHA512e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b
-
Filesize
255KB
MD5dd5045eef78d00648ddcf9f4e72e9325
SHA1e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a
SHA2568e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02
SHA512e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b
-
Filesize
255KB
MD541aa06bb457b1221c88d42467916aee6
SHA1eae4771749505dfa127b562160a0a33c03d78823
SHA256e96a756a2d504b5032d2b8a625ee448bb982f0fe8ac887d37a90c1a2116e949d
SHA512d61b8df3cf1ccf15ca57b226c1a474342dfbd43b159a10fcac6905fceafad8ac6824178f9f6b0b145c1aa22726b04dcfe96df8f91e3c26435f9ed70c2bd561e1
-
Filesize
255KB
MD541aa06bb457b1221c88d42467916aee6
SHA1eae4771749505dfa127b562160a0a33c03d78823
SHA256e96a756a2d504b5032d2b8a625ee448bb982f0fe8ac887d37a90c1a2116e949d
SHA512d61b8df3cf1ccf15ca57b226c1a474342dfbd43b159a10fcac6905fceafad8ac6824178f9f6b0b145c1aa22726b04dcfe96df8f91e3c26435f9ed70c2bd561e1
-
Filesize
255KB
MD52f17221bf5cd7aeefb796fe4f297612c
SHA1c52256ca97ebf96c2df976b72073a18c0392b468
SHA2561313a8910bf9a96d156d736f7402b3b2e13ec10133a58c116e680630af15932b
SHA512ea2f975d9f11dbdff6597516d2edb1bdff71892e13dd5fe8867b2e08297c5ee0ecf3ffa818775b2587759fd1cc9de24ab44deef631547cc54fd5aa68e479a5db
-
Filesize
255KB
MD52f17221bf5cd7aeefb796fe4f297612c
SHA1c52256ca97ebf96c2df976b72073a18c0392b468
SHA2561313a8910bf9a96d156d736f7402b3b2e13ec10133a58c116e680630af15932b
SHA512ea2f975d9f11dbdff6597516d2edb1bdff71892e13dd5fe8867b2e08297c5ee0ecf3ffa818775b2587759fd1cc9de24ab44deef631547cc54fd5aa68e479a5db
-
Filesize
255KB
MD51c30632be1902da43e5518436e219ff9
SHA1bdda0c10ae20d61282390570ee4e7aab98214ae2
SHA2568ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3
SHA51277802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244
-
Filesize
255KB
MD51c30632be1902da43e5518436e219ff9
SHA1bdda0c10ae20d61282390570ee4e7aab98214ae2
SHA2568ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3
SHA51277802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244
-
Filesize
255KB
MD51c30632be1902da43e5518436e219ff9
SHA1bdda0c10ae20d61282390570ee4e7aab98214ae2
SHA2568ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3
SHA51277802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5dd5045eef78d00648ddcf9f4e72e9325
SHA1e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a
SHA2568e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02
SHA512e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b
-
Filesize
255KB
MD5dd5045eef78d00648ddcf9f4e72e9325
SHA1e6de4bd4b8947d2ef16c7c108e7dda41cb58be2a
SHA2568e222d8e9055bf95f069dcaec08f0b28a1e465f1123a81cd24131afc4992da02
SHA512e930e3308f22c59d0c667e6b915eab96179239dabec0166e735ed0ecf82d65aa19bae02d894ad37d820f6a4b4659fa6254b65f4ae724a76f0d1b3aa7b036245b
-
Filesize
255KB
MD541aa06bb457b1221c88d42467916aee6
SHA1eae4771749505dfa127b562160a0a33c03d78823
SHA256e96a756a2d504b5032d2b8a625ee448bb982f0fe8ac887d37a90c1a2116e949d
SHA512d61b8df3cf1ccf15ca57b226c1a474342dfbd43b159a10fcac6905fceafad8ac6824178f9f6b0b145c1aa22726b04dcfe96df8f91e3c26435f9ed70c2bd561e1
-
Filesize
255KB
MD52f17221bf5cd7aeefb796fe4f297612c
SHA1c52256ca97ebf96c2df976b72073a18c0392b468
SHA2561313a8910bf9a96d156d736f7402b3b2e13ec10133a58c116e680630af15932b
SHA512ea2f975d9f11dbdff6597516d2edb1bdff71892e13dd5fe8867b2e08297c5ee0ecf3ffa818775b2587759fd1cc9de24ab44deef631547cc54fd5aa68e479a5db
-
Filesize
255KB
MD51c30632be1902da43e5518436e219ff9
SHA1bdda0c10ae20d61282390570ee4e7aab98214ae2
SHA2568ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3
SHA51277802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244
-
Filesize
255KB
MD51c30632be1902da43e5518436e219ff9
SHA1bdda0c10ae20d61282390570ee4e7aab98214ae2
SHA2568ca094c4c490cced1d820c963c8ef92e26d404f4ac788eaf917d06dcee8b41d3
SHA51277802da9dfc5b7818f5fb65d61b2468e542df207a0a5137acd60d7991c8cbdc34a0802c6cd71b75c88e91b193a910fd812e0d77e9893295e4a9d71e812b33244