b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb

Analysis

max time kernel
152s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
Size

255KB
MD5

4bd5c40959b71c897229aba22ef0f6a1
SHA1

a382a5864ddbc0b8728d18c232b39dd96f50c73f
SHA256

b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb
SHA512

e44cb9b23645c51b77caebf031ffd981c12939644a911f2fb387612cd4a9951c2274bfb42f5ec06f69002a63a5eccc5c0f8197eef6c147c35c9d62beb270a1c5
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJV:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIw

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ahrpvaedcw.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ahrpvaedcw.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ahrpvaedcw.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ahrpvaedcw.exe

Executes dropped EXE 5 IoCs

pid	Process
1684	ahrpvaedcw.exe
1744	jvtdptcebqnausl.exe
1288	nwmetfus.exe
1708	sdztrwpqlavnf.exe
1320	nwmetfus.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2000-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-56.dat	upx
behavioral1/memory/2000-57-0x0000000002F90000-0x0000000003030000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-59.dat	upx
behavioral1/files/0x000b0000000122ca-60.dat	upx
behavioral1/files/0x0007000000005c50-63.dat	upx
behavioral1/files/0x000b0000000122ca-64.dat	upx
behavioral1/files/0x000b0000000122ca-66.dat	upx
behavioral1/files/0x000a0000000122cc-67.dat	upx
behavioral1/files/0x000a0000000122cc-69.dat	upx
behavioral1/files/0x000a0000000122cc-73.dat	upx
behavioral1/files/0x00090000000122da-72.dat	upx
behavioral1/files/0x00090000000122da-75.dat	upx
behavioral1/files/0x00090000000122da-77.dat	upx
behavioral1/memory/1684-78-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1744-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1288-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1708-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x000a0000000122cc-83.dat	upx
behavioral1/files/0x000a0000000122cc-85.dat	upx
behavioral1/memory/1320-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2000-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1684-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1744-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1288-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1708-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1320-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x000700000001311d-104.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
1684	ahrpvaedcw.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ahrpvaedcw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	jvtdptcebqnausl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kyfffwwb = "ahrpvaedcw.exe"	jvtdptcebqnausl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iqmmgdmf = "jvtdptcebqnausl.exe"	jvtdptcebqnausl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "sdztrwpqlavnf.exe"	jvtdptcebqnausl.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	nwmetfus.exe
File opened (read-only)	\??\u:	nwmetfus.exe
File opened (read-only)	\??\e:	ahrpvaedcw.exe
File opened (read-only)	\??\l:	ahrpvaedcw.exe
File opened (read-only)	\??\o:	ahrpvaedcw.exe
File opened (read-only)	\??\v:	nwmetfus.exe
File opened (read-only)	\??\n:	nwmetfus.exe
File opened (read-only)	\??\t:	nwmetfus.exe
File opened (read-only)	\??\k:	nwmetfus.exe
File opened (read-only)	\??\o:	nwmetfus.exe
File opened (read-only)	\??\p:	nwmetfus.exe
File opened (read-only)	\??\y:	nwmetfus.exe
File opened (read-only)	\??\f:	nwmetfus.exe
File opened (read-only)	\??\n:	nwmetfus.exe
File opened (read-only)	\??\y:	nwmetfus.exe
File opened (read-only)	\??\b:	nwmetfus.exe
File opened (read-only)	\??\m:	nwmetfus.exe
File opened (read-only)	\??\q:	nwmetfus.exe
File opened (read-only)	\??\i:	ahrpvaedcw.exe
File opened (read-only)	\??\u:	nwmetfus.exe
File opened (read-only)	\??\w:	ahrpvaedcw.exe
File opened (read-only)	\??\g:	nwmetfus.exe
File opened (read-only)	\??\j:	nwmetfus.exe
File opened (read-only)	\??\b:	nwmetfus.exe
File opened (read-only)	\??\g:	nwmetfus.exe
File opened (read-only)	\??\j:	ahrpvaedcw.exe
File opened (read-only)	\??\r:	ahrpvaedcw.exe
File opened (read-only)	\??\f:	nwmetfus.exe
File opened (read-only)	\??\q:	ahrpvaedcw.exe
File opened (read-only)	\??\t:	ahrpvaedcw.exe
File opened (read-only)	\??\e:	nwmetfus.exe
File opened (read-only)	\??\i:	nwmetfus.exe
File opened (read-only)	\??\p:	nwmetfus.exe
File opened (read-only)	\??\f:	ahrpvaedcw.exe
File opened (read-only)	\??\m:	ahrpvaedcw.exe
File opened (read-only)	\??\a:	nwmetfus.exe
File opened (read-only)	\??\n:	ahrpvaedcw.exe
File opened (read-only)	\??\z:	nwmetfus.exe
File opened (read-only)	\??\h:	nwmetfus.exe
File opened (read-only)	\??\v:	nwmetfus.exe
File opened (read-only)	\??\j:	nwmetfus.exe
File opened (read-only)	\??\v:	ahrpvaedcw.exe
File opened (read-only)	\??\z:	ahrpvaedcw.exe
File opened (read-only)	\??\a:	nwmetfus.exe
File opened (read-only)	\??\r:	nwmetfus.exe
File opened (read-only)	\??\h:	nwmetfus.exe
File opened (read-only)	\??\b:	ahrpvaedcw.exe
File opened (read-only)	\??\i:	nwmetfus.exe
File opened (read-only)	\??\q:	nwmetfus.exe
File opened (read-only)	\??\z:	nwmetfus.exe
File opened (read-only)	\??\o:	nwmetfus.exe
File opened (read-only)	\??\r:	nwmetfus.exe
File opened (read-only)	\??\w:	nwmetfus.exe
File opened (read-only)	\??\u:	ahrpvaedcw.exe
File opened (read-only)	\??\y:	ahrpvaedcw.exe
File opened (read-only)	\??\l:	nwmetfus.exe
File opened (read-only)	\??\t:	nwmetfus.exe
File opened (read-only)	\??\s:	ahrpvaedcw.exe
File opened (read-only)	\??\x:	ahrpvaedcw.exe
File opened (read-only)	\??\w:	nwmetfus.exe
File opened (read-only)	\??\x:	nwmetfus.exe
File opened (read-only)	\??\k:	nwmetfus.exe
File opened (read-only)	\??\s:	nwmetfus.exe
File opened (read-only)	\??\a:	ahrpvaedcw.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	ahrpvaedcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	ahrpvaedcw.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2000-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1684-78-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1744-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1288-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1708-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1320-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2000-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1684-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1744-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1288-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1708-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1320-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nwmetfus.exe	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	ahrpvaedcw.exe
File created	C:\Windows\SysWOW64\ahrpvaedcw.exe	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
File created	C:\Windows\SysWOW64\jvtdptcebqnausl.exe	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
File opened for modification	C:\Windows\SysWOW64\jvtdptcebqnausl.exe	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
File opened for modification	C:\Windows\SysWOW64\nwmetfus.exe	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
File created	C:\Windows\SysWOW64\sdztrwpqlavnf.exe	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
File opened for modification	C:\Windows\SysWOW64\sdztrwpqlavnf.exe	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
File opened for modification	C:\Windows\SysWOW64\ahrpvaedcw.exe	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	nwmetfus.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nwmetfus.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nwmetfus.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nwmetfus.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nwmetfus.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	nwmetfus.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	nwmetfus.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nwmetfus.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nwmetfus.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nwmetfus.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	nwmetfus.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nwmetfus.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nwmetfus.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nwmetfus.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nwmetfus.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1849C7091594DAB6B8BA7CE0ED9334CF"	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	ahrpvaedcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78368C3FE1D21DED209D1A98B7E9113"	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABFF9C9FE10F1E284093A4586983994B08D038A43660338E2CB459C08A6"	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	ahrpvaedcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	ahrpvaedcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	ahrpvaedcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1504	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
1684	ahrpvaedcw.exe
1684	ahrpvaedcw.exe
1684	ahrpvaedcw.exe
1684	ahrpvaedcw.exe
1684	ahrpvaedcw.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
1288	nwmetfus.exe
1288	nwmetfus.exe
1288	nwmetfus.exe
1288	nwmetfus.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1320	nwmetfus.exe
1320	nwmetfus.exe
1320	nwmetfus.exe
1320	nwmetfus.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1744	jvtdptcebqnausl.exe
1708	sdztrwpqlavnf.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
1684	ahrpvaedcw.exe
1684	ahrpvaedcw.exe
1684	ahrpvaedcw.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
1288	nwmetfus.exe
1288	nwmetfus.exe
1288	nwmetfus.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1320	nwmetfus.exe
1320	nwmetfus.exe
1320	nwmetfus.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
1684	ahrpvaedcw.exe
1684	ahrpvaedcw.exe
1684	ahrpvaedcw.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
1744	jvtdptcebqnausl.exe
1288	nwmetfus.exe
1288	nwmetfus.exe
1288	nwmetfus.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1708	sdztrwpqlavnf.exe
1320	nwmetfus.exe
1320	nwmetfus.exe
1320	nwmetfus.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1504	WINWORD.EXE
1504	WINWORD.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1684	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	26
PID 2000 wrote to memory of 1684	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	26
PID 2000 wrote to memory of 1684	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	26
PID 2000 wrote to memory of 1684	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	26
PID 2000 wrote to memory of 1744	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	27
PID 2000 wrote to memory of 1744	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	27
PID 2000 wrote to memory of 1744	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	27
PID 2000 wrote to memory of 1744	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	27
PID 2000 wrote to memory of 1288	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	28
PID 2000 wrote to memory of 1288	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	28
PID 2000 wrote to memory of 1288	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	28
PID 2000 wrote to memory of 1288	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	28
PID 1744 wrote to memory of 2040	1744	jvtdptcebqnausl.exe	29
PID 1744 wrote to memory of 2040	1744	jvtdptcebqnausl.exe	29
PID 1744 wrote to memory of 2040	1744	jvtdptcebqnausl.exe	29
PID 1744 wrote to memory of 2040	1744	jvtdptcebqnausl.exe	29
PID 2000 wrote to memory of 1708	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	31
PID 2000 wrote to memory of 1708	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	31
PID 2000 wrote to memory of 1708	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	31
PID 2000 wrote to memory of 1708	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	31
PID 1684 wrote to memory of 1320	1684	ahrpvaedcw.exe	32
PID 1684 wrote to memory of 1320	1684	ahrpvaedcw.exe	32
PID 1684 wrote to memory of 1320	1684	ahrpvaedcw.exe	32
PID 1684 wrote to memory of 1320	1684	ahrpvaedcw.exe	32
PID 2000 wrote to memory of 1504	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	33
PID 2000 wrote to memory of 1504	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	33
PID 2000 wrote to memory of 1504	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	33
PID 2000 wrote to memory of 1504	2000	b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe	33
PID 1504 wrote to memory of 1012	1504	WINWORD.EXE	37
PID 1504 wrote to memory of 1012	1504	WINWORD.EXE	37
PID 1504 wrote to memory of 1012	1504	WINWORD.EXE	37
PID 1504 wrote to memory of 1012	1504	WINWORD.EXE	37

C:\Users\Admin\AppData\Local\Temp\b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
"C:\Users\Admin\AppData\Local\Temp\b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\ahrpvaedcw.exe
  ahrpvaedcw.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\nwmetfus.exe
    C:\Windows\system32\nwmetfus.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1320
- C:\Windows\SysWOW64\jvtdptcebqnausl.exe
  jvtdptcebqnausl.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c sdztrwpqlavnf.exe
    3⤵
    PID:2040
- C:\Windows\SysWOW64\nwmetfus.exe
  nwmetfus.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1288
- C:\Windows\SysWOW64\sdztrwpqlavnf.exe
  sdztrwpqlavnf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1708
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ahrpvaedcw.exe

Filesize
255KB

MD5
1d03f32cac6d5c0039f6565d132489ec

SHA1
7c1d70792f353e15e88895ce680458e2aeb66cab

SHA256
b2cd9d6384a15ba3af76642a31241ff399c567e6aa80c2e65282f31208731cba

SHA512
b9b78dfaee94e74332cfab408a840ba5d0e024ef209c62a3373173b6af26d97e606f0e11113f4aabd3f955d7c1993ad635b561ffc3c5f31813a69bd3e8b783b1

Download Submit
C:\Windows\SysWOW64\ahrpvaedcw.exe

Filesize
255KB

MD5
1d03f32cac6d5c0039f6565d132489ec

SHA1
7c1d70792f353e15e88895ce680458e2aeb66cab

SHA256
b2cd9d6384a15ba3af76642a31241ff399c567e6aa80c2e65282f31208731cba

SHA512
b9b78dfaee94e74332cfab408a840ba5d0e024ef209c62a3373173b6af26d97e606f0e11113f4aabd3f955d7c1993ad635b561ffc3c5f31813a69bd3e8b783b1

Download Submit
C:\Windows\SysWOW64\jvtdptcebqnausl.exe

Filesize
255KB

MD5
c37486ec071ccb330f38738c2465eef4

SHA1
46146dde96074e8d572b5ebefd33140879a8d6c9

SHA256
b55b4f2bac3f381ee79bc63d3cbc82de5c0b4c5429e08643209be3bfa1a54d70

SHA512
772000afbd4052320191f5bfdadc7a3667ca4c971800e0d0312ec6f9e882ebb4ea279100905217a789ec3655be449dacc94dee0cf4033b35c19af0c2af3a9c4a

Download Submit
C:\Windows\SysWOW64\jvtdptcebqnausl.exe

Filesize
255KB

MD5
c37486ec071ccb330f38738c2465eef4

SHA1
46146dde96074e8d572b5ebefd33140879a8d6c9

SHA256
b55b4f2bac3f381ee79bc63d3cbc82de5c0b4c5429e08643209be3bfa1a54d70

SHA512
772000afbd4052320191f5bfdadc7a3667ca4c971800e0d0312ec6f9e882ebb4ea279100905217a789ec3655be449dacc94dee0cf4033b35c19af0c2af3a9c4a

Download Submit
C:\Windows\SysWOW64\nwmetfus.exe

Filesize
255KB

MD5
eb670aa491a0ea06681298fdd403485b

SHA1
a9e77477da8d725f7b1c7dbe61f4be5bfdf3178e

SHA256
763b6ad9d543d149b390261048d1ea43b2535d2e6dd9d4d2ac9ddd70c04ee8fd

SHA512
e4ba69983c520f90fe5038fd354ef927f27b4dec3238319b348a74c8a1c95ce102669b54ea3c3661590906b888e63d3cb508b2f8a37973892bad9f0567899409

Download Submit
C:\Windows\SysWOW64\nwmetfus.exe

Filesize
255KB

MD5
eb670aa491a0ea06681298fdd403485b

SHA1
a9e77477da8d725f7b1c7dbe61f4be5bfdf3178e

SHA256
763b6ad9d543d149b390261048d1ea43b2535d2e6dd9d4d2ac9ddd70c04ee8fd

SHA512
e4ba69983c520f90fe5038fd354ef927f27b4dec3238319b348a74c8a1c95ce102669b54ea3c3661590906b888e63d3cb508b2f8a37973892bad9f0567899409

Download Submit
C:\Windows\SysWOW64\nwmetfus.exe

Filesize
255KB

MD5
eb670aa491a0ea06681298fdd403485b

SHA1
a9e77477da8d725f7b1c7dbe61f4be5bfdf3178e

SHA256
763b6ad9d543d149b390261048d1ea43b2535d2e6dd9d4d2ac9ddd70c04ee8fd

SHA512
e4ba69983c520f90fe5038fd354ef927f27b4dec3238319b348a74c8a1c95ce102669b54ea3c3661590906b888e63d3cb508b2f8a37973892bad9f0567899409

Download Submit
C:\Windows\SysWOW64\sdztrwpqlavnf.exe

Filesize
255KB

MD5
eac2b257b86522a6d49cce8c499e5632

SHA1
fedd8305938c9dc5b97db01f15cd27f788d7c247

SHA256
f8d14621dcb705f0e6d5623ea16de6dd98e861afd34b528102d7f7ec13191f71

SHA512
409b1b6e1b04ecb0a32af378fa3eadc12924270c2a494544a3b1f25217d4f0c2704b283d8aa772454c6055d2885e01f26476a76ed3408190edaaec9ab2f359ba

Download Submit
C:\Windows\SysWOW64\sdztrwpqlavnf.exe

Filesize
255KB

MD5
eac2b257b86522a6d49cce8c499e5632

SHA1
fedd8305938c9dc5b97db01f15cd27f788d7c247

SHA256
f8d14621dcb705f0e6d5623ea16de6dd98e861afd34b528102d7f7ec13191f71

SHA512
409b1b6e1b04ecb0a32af378fa3eadc12924270c2a494544a3b1f25217d4f0c2704b283d8aa772454c6055d2885e01f26476a76ed3408190edaaec9ab2f359ba

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
829b9dfcb3f8436225afac9b188a8c93

SHA1
04dd5bd413168cdbca3ee76d1cfc0bd53df66afe

SHA256
9794bb1675ac2838eff593c029e80fc1432edae2f6e9285a58a9b708d9a788e0

SHA512
9e1b24ad461e639138b44f795f4220c3d00212c043ccda8da3aa1b9497d9e20c826eea6f29c0394a1be62df2bad134d9c765299cba3582a1dd9edc6aff883bc2

Download Submit
\Windows\SysWOW64\ahrpvaedcw.exe

Filesize
255KB

MD5
1d03f32cac6d5c0039f6565d132489ec

SHA1
7c1d70792f353e15e88895ce680458e2aeb66cab

SHA256
b2cd9d6384a15ba3af76642a31241ff399c567e6aa80c2e65282f31208731cba

SHA512
b9b78dfaee94e74332cfab408a840ba5d0e024ef209c62a3373173b6af26d97e606f0e11113f4aabd3f955d7c1993ad635b561ffc3c5f31813a69bd3e8b783b1

Download Submit
\Windows\SysWOW64\jvtdptcebqnausl.exe

Filesize
255KB

MD5
c37486ec071ccb330f38738c2465eef4

SHA1
46146dde96074e8d572b5ebefd33140879a8d6c9

SHA256
b55b4f2bac3f381ee79bc63d3cbc82de5c0b4c5429e08643209be3bfa1a54d70

SHA512
772000afbd4052320191f5bfdadc7a3667ca4c971800e0d0312ec6f9e882ebb4ea279100905217a789ec3655be449dacc94dee0cf4033b35c19af0c2af3a9c4a

Download Submit
\Windows\SysWOW64\nwmetfus.exe

Filesize
255KB

MD5
eb670aa491a0ea06681298fdd403485b

SHA1
a9e77477da8d725f7b1c7dbe61f4be5bfdf3178e

SHA256
763b6ad9d543d149b390261048d1ea43b2535d2e6dd9d4d2ac9ddd70c04ee8fd

SHA512
e4ba69983c520f90fe5038fd354ef927f27b4dec3238319b348a74c8a1c95ce102669b54ea3c3661590906b888e63d3cb508b2f8a37973892bad9f0567899409

Download Submit
\Windows\SysWOW64\nwmetfus.exe

Filesize
255KB

MD5
eb670aa491a0ea06681298fdd403485b

SHA1
a9e77477da8d725f7b1c7dbe61f4be5bfdf3178e

SHA256
763b6ad9d543d149b390261048d1ea43b2535d2e6dd9d4d2ac9ddd70c04ee8fd

SHA512
e4ba69983c520f90fe5038fd354ef927f27b4dec3238319b348a74c8a1c95ce102669b54ea3c3661590906b888e63d3cb508b2f8a37973892bad9f0567899409

Download Submit
\Windows\SysWOW64\sdztrwpqlavnf.exe

Filesize
255KB

MD5
eac2b257b86522a6d49cce8c499e5632

SHA1
fedd8305938c9dc5b97db01f15cd27f788d7c247

SHA256
f8d14621dcb705f0e6d5623ea16de6dd98e861afd34b528102d7f7ec13191f71

SHA512
409b1b6e1b04ecb0a32af378fa3eadc12924270c2a494544a3b1f25217d4f0c2704b283d8aa772454c6055d2885e01f26476a76ed3408190edaaec9ab2f359ba

Download Submit
memory/1012-103-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download
memory/1288-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1288-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1320-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1320-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1504-90-0x0000000072251000-0x0000000072254000-memory.dmp

Filesize
12KB

Download
memory/1504-95-0x000000006FCD1000-0x000000006FCD3000-memory.dmp

Filesize
8KB

Download
memory/1504-101-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

Filesize
44KB

Download
memory/1504-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1504-98-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

Filesize
44KB

Download
memory/1684-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1684-78-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1708-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1708-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1744-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1744-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2000-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2000-54-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/2000-79-0x0000000002F90000-0x0000000003030000-memory.dmp

Filesize
640KB

Download
memory/2000-57-0x0000000002F90000-0x0000000003030000-memory.dmp

Filesize
640KB

Download
memory/2000-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download