a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74

Analysis

max time kernel
151s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
Size

255KB
MD5

0846cb3dd0182d5768208d5914dcd21c
SHA1

f0dac90a1c5b9ce64551c993970d428daf98151b
SHA256

a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74
SHA512

5a59c07eb236b17d09b2ef1b5e69115f67e21776aa5d8645e77f23a5ebd3a1930046b3a0908590aed14487424b2274f49c2a50c6acdc6095d9ea594915869a12
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJD:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIm

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	qagmcscbxw.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qagmcscbxw.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qagmcscbxw.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	qagmcscbxw.exe

Executes dropped EXE 5 IoCs

pid	Process
1704	qagmcscbxw.exe
1684	tueqhitztjhrtll.exe
1680	lgpmlvwd.exe
1616	ofeeoievkzugc.exe
360	lgpmlvwd.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000005c51-55.dat	upx
behavioral1/files/0x0008000000005c51-57.dat	upx
behavioral1/files/0x000800000001435a-58.dat	upx
behavioral1/files/0x000800000001435a-61.dat	upx
behavioral1/files/0x000700000001468b-63.dat	upx
behavioral1/files/0x00060000000146af-73.dat	upx
behavioral1/files/0x0008000000005c51-68.dat	upx
behavioral1/files/0x000800000001435a-66.dat	upx
behavioral1/files/0x00060000000146af-71.dat	upx
behavioral1/files/0x000700000001468b-74.dat	upx
behavioral1/files/0x00060000000146af-69.dat	upx
behavioral1/files/0x000700000001468b-65.dat	upx
behavioral1/files/0x000700000001468b-75.dat	upx
behavioral1/files/0x000700000001468b-77.dat	upx
behavioral1/memory/1456-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1704-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1684-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1680-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1616-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/360-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1456-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00060000000155fa-94.dat	upx
behavioral1/files/0x0006000000015c2b-95.dat	upx
behavioral1/files/0x0006000000015c3c-96.dat	upx
behavioral1/memory/1704-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1684-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1680-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1616-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/360-101-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/360-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1680-105-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1704	qagmcscbxw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qagmcscbxw.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	tueqhitztjhrtll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xwrzllbj = "qagmcscbxw.exe"	tueqhitztjhrtll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wargwhor = "tueqhitztjhrtll.exe"	tueqhitztjhrtll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ofeeoievkzugc.exe"	tueqhitztjhrtll.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	qagmcscbxw.exe
File opened (read-only)	\??\n:	lgpmlvwd.exe
File opened (read-only)	\??\r:	lgpmlvwd.exe
File opened (read-only)	\??\i:	lgpmlvwd.exe
File opened (read-only)	\??\s:	lgpmlvwd.exe
File opened (read-only)	\??\z:	lgpmlvwd.exe
File opened (read-only)	\??\f:	lgpmlvwd.exe
File opened (read-only)	\??\y:	lgpmlvwd.exe
File opened (read-only)	\??\a:	lgpmlvwd.exe
File opened (read-only)	\??\g:	lgpmlvwd.exe
File opened (read-only)	\??\h:	qagmcscbxw.exe
File opened (read-only)	\??\n:	lgpmlvwd.exe
File opened (read-only)	\??\j:	qagmcscbxw.exe
File opened (read-only)	\??\z:	lgpmlvwd.exe
File opened (read-only)	\??\w:	qagmcscbxw.exe
File opened (read-only)	\??\b:	lgpmlvwd.exe
File opened (read-only)	\??\u:	lgpmlvwd.exe
File opened (read-only)	\??\m:	lgpmlvwd.exe
File opened (read-only)	\??\x:	lgpmlvwd.exe
File opened (read-only)	\??\s:	qagmcscbxw.exe
File opened (read-only)	\??\y:	qagmcscbxw.exe
File opened (read-only)	\??\z:	qagmcscbxw.exe
File opened (read-only)	\??\g:	lgpmlvwd.exe
File opened (read-only)	\??\o:	lgpmlvwd.exe
File opened (read-only)	\??\t:	lgpmlvwd.exe
File opened (read-only)	\??\q:	lgpmlvwd.exe
File opened (read-only)	\??\a:	qagmcscbxw.exe
File opened (read-only)	\??\f:	qagmcscbxw.exe
File opened (read-only)	\??\j:	lgpmlvwd.exe
File opened (read-only)	\??\m:	qagmcscbxw.exe
File opened (read-only)	\??\v:	qagmcscbxw.exe
File opened (read-only)	\??\j:	lgpmlvwd.exe
File opened (read-only)	\??\q:	lgpmlvwd.exe
File opened (read-only)	\??\k:	lgpmlvwd.exe
File opened (read-only)	\??\v:	lgpmlvwd.exe
File opened (read-only)	\??\b:	qagmcscbxw.exe
File opened (read-only)	\??\i:	lgpmlvwd.exe
File opened (read-only)	\??\m:	lgpmlvwd.exe
File opened (read-only)	\??\v:	lgpmlvwd.exe
File opened (read-only)	\??\l:	lgpmlvwd.exe
File opened (read-only)	\??\t:	qagmcscbxw.exe
File opened (read-only)	\??\h:	lgpmlvwd.exe
File opened (read-only)	\??\o:	qagmcscbxw.exe
File opened (read-only)	\??\p:	qagmcscbxw.exe
File opened (read-only)	\??\w:	lgpmlvwd.exe
File opened (read-only)	\??\g:	qagmcscbxw.exe
File opened (read-only)	\??\k:	lgpmlvwd.exe
File opened (read-only)	\??\n:	qagmcscbxw.exe
File opened (read-only)	\??\r:	qagmcscbxw.exe
File opened (read-only)	\??\p:	lgpmlvwd.exe
File opened (read-only)	\??\o:	lgpmlvwd.exe
File opened (read-only)	\??\u:	lgpmlvwd.exe
File opened (read-only)	\??\w:	lgpmlvwd.exe
File opened (read-only)	\??\u:	qagmcscbxw.exe
File opened (read-only)	\??\h:	lgpmlvwd.exe
File opened (read-only)	\??\p:	lgpmlvwd.exe
File opened (read-only)	\??\y:	lgpmlvwd.exe
File opened (read-only)	\??\e:	qagmcscbxw.exe
File opened (read-only)	\??\i:	qagmcscbxw.exe
File opened (read-only)	\??\q:	qagmcscbxw.exe
File opened (read-only)	\??\s:	lgpmlvwd.exe
File opened (read-only)	\??\x:	lgpmlvwd.exe
File opened (read-only)	\??\b:	lgpmlvwd.exe
File opened (read-only)	\??\e:	lgpmlvwd.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	qagmcscbxw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	qagmcscbxw.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1456-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1704-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1684-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1680-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1616-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/360-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1456-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1704-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1684-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1680-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1616-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/360-101-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/360-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1680-105-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qagmcscbxw.exe	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
File opened for modification	C:\Windows\SysWOW64\tueqhitztjhrtll.exe	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
File created	C:\Windows\SysWOW64\ofeeoievkzugc.exe	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
File opened for modification	C:\Windows\SysWOW64\ofeeoievkzugc.exe	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	qagmcscbxw.exe
File opened for modification	C:\Windows\SysWOW64\qagmcscbxw.exe	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
File created	C:\Windows\SysWOW64\tueqhitztjhrtll.exe	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
File created	C:\Windows\SysWOW64\lgpmlvwd.exe	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
File opened for modification	C:\Windows\SysWOW64\lgpmlvwd.exe	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\OutImport.doc.exe	lgpmlvwd.exe
File opened for modification	C:\Program Files\OutImport.nal	lgpmlvwd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	lgpmlvwd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	lgpmlvwd.exe
File created	\??\c:\Program Files\OutImport.doc.exe	lgpmlvwd.exe
File opened for modification	C:\Program Files\OutImport.nal	lgpmlvwd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	lgpmlvwd.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	lgpmlvwd.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	lgpmlvwd.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	lgpmlvwd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	lgpmlvwd.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	lgpmlvwd.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	lgpmlvwd.exe
File opened for modification	C:\Program Files\OutImport.doc.exe	lgpmlvwd.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	lgpmlvwd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	lgpmlvwd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	lgpmlvwd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	lgpmlvwd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	lgpmlvwd.exe
File opened for modification	\??\c:\Program Files\OutImport.doc.exe	lgpmlvwd.exe
File opened for modification	C:\Program Files\OutImport.doc.exe	lgpmlvwd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08668B2FF6622A9D27CD0A28A7B9160"	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	qagmcscbxw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	qagmcscbxw.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC8F9B1F913F29883783B31819F3EE2B38B02FE4360023BE2CA42EC08A6"	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	qagmcscbxw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	qagmcscbxw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC60914E0DAC7B9BA7C95ED9137CB"	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	qagmcscbxw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	qagmcscbxw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	qagmcscbxw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1224	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1684	tueqhitztjhrtll.exe
1684	tueqhitztjhrtll.exe
1684	tueqhitztjhrtll.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1680	lgpmlvwd.exe
1680	lgpmlvwd.exe
1680	lgpmlvwd.exe
1680	lgpmlvwd.exe
1704	qagmcscbxw.exe
1704	qagmcscbxw.exe
1704	qagmcscbxw.exe
1704	qagmcscbxw.exe
1704	qagmcscbxw.exe
360	lgpmlvwd.exe
360	lgpmlvwd.exe
360	lgpmlvwd.exe
360	lgpmlvwd.exe
1684	tueqhitztjhrtll.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1684	tueqhitztjhrtll.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1684	tueqhitztjhrtll.exe
1684	tueqhitztjhrtll.exe
1684	tueqhitztjhrtll.exe
1704	qagmcscbxw.exe
1704	qagmcscbxw.exe
1704	qagmcscbxw.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1680	lgpmlvwd.exe
1680	lgpmlvwd.exe
1680	lgpmlvwd.exe
360	lgpmlvwd.exe
360	lgpmlvwd.exe
360	lgpmlvwd.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
1684	tueqhitztjhrtll.exe
1684	tueqhitztjhrtll.exe
1684	tueqhitztjhrtll.exe
1704	qagmcscbxw.exe
1704	qagmcscbxw.exe
1704	qagmcscbxw.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1616	ofeeoievkzugc.exe
1680	lgpmlvwd.exe
1680	lgpmlvwd.exe
1680	lgpmlvwd.exe
360	lgpmlvwd.exe
360	lgpmlvwd.exe
360	lgpmlvwd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1224	WINWORD.EXE
1224	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1704	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	26
PID 1456 wrote to memory of 1704	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	26
PID 1456 wrote to memory of 1704	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	26
PID 1456 wrote to memory of 1704	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	26
PID 1456 wrote to memory of 1684	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	27
PID 1456 wrote to memory of 1684	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	27
PID 1456 wrote to memory of 1684	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	27
PID 1456 wrote to memory of 1684	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	27
PID 1456 wrote to memory of 1680	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	28
PID 1456 wrote to memory of 1680	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	28
PID 1456 wrote to memory of 1680	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	28
PID 1456 wrote to memory of 1680	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	28
PID 1456 wrote to memory of 1616	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	29
PID 1456 wrote to memory of 1616	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	29
PID 1456 wrote to memory of 1616	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	29
PID 1456 wrote to memory of 1616	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	29
PID 1704 wrote to memory of 360	1704	qagmcscbxw.exe	30
PID 1704 wrote to memory of 360	1704	qagmcscbxw.exe	30
PID 1704 wrote to memory of 360	1704	qagmcscbxw.exe	30
PID 1704 wrote to memory of 360	1704	qagmcscbxw.exe	30
PID 1456 wrote to memory of 1224	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	31
PID 1456 wrote to memory of 1224	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	31
PID 1456 wrote to memory of 1224	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	31
PID 1456 wrote to memory of 1224	1456	a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe	31
PID 1224 wrote to memory of 560	1224	WINWORD.EXE	35
PID 1224 wrote to memory of 560	1224	WINWORD.EXE	35
PID 1224 wrote to memory of 560	1224	WINWORD.EXE	35
PID 1224 wrote to memory of 560	1224	WINWORD.EXE	35

C:\Users\Admin\AppData\Local\Temp\a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe
"C:\Users\Admin\AppData\Local\Temp\a4292584443fc4ffee7e3f68e052274f55e3d4132cf64f79a820a2b7a4c06d74.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\qagmcscbxw.exe
  qagmcscbxw.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\lgpmlvwd.exe
    C:\Windows\system32\lgpmlvwd.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:360
- C:\Windows\SysWOW64\tueqhitztjhrtll.exe
  tueqhitztjhrtll.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1684
- C:\Windows\SysWOW64\lgpmlvwd.exe
  lgpmlvwd.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1680
- C:\Windows\SysWOW64\ofeeoievkzugc.exe
  ofeeoievkzugc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1616
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
4cdd3fe8efc3223664b78e9e6bd123ed

SHA1
a771aca3594175e05ec840c2d4b0ece2265092a1

SHA256
48b6feefaca29ef886fea7dc91cebb24e2fe5a2bd9e83592419f02ac2d5194b4

SHA512
b335f7256b9be1925efbb90274a1fd78ca0f3a4a3d9096fe60f163b14ab0685ff3c53efcb2577b08367b4c5d9b7586595bbb4c45d894fc647b945cc3906f64b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
52cfceefab577a9872e0bdede6c38ecb

SHA1
dea6819d2fa683f33395ac452ae29832613efeef

SHA256
84578c6b9443fa240a599edf7485a0ec7113102476ca8e080dfc92d710345d83

SHA512
1f5f9dea7e7574dd26f864aa9a46ece3ab0bfc0200680f840546964b339f73fda286064e41245d87faaabfb9bf6f6a160615de4737220a762af832302c07966b

Download Submit
C:\Program Files\OutImport.doc.exe

Filesize
255KB

MD5
7eb6e97f325040e32c837e22831c6d58

SHA1
191d37d5ed70a07b43c78386dcfc4863f5e5c810

SHA256
a6283a5679dcc2362ea27fea11ad0e75e1f28602ef695e2b7f902dac3ac327e7

SHA512
026e414b022f0ca6649f307fb7f8608d1a4ef0644056f0800eb3f602e01c0851416b755f43174cf662427e361ebaf1d4a444b784a4ed64ed16aaba9e0face732

Download Submit
C:\Windows\SysWOW64\lgpmlvwd.exe

Filesize
255KB

MD5
22e24f8a47b5f8e976338f8ab9247bcb

SHA1
26a431c04a57a59bb7d3ffba25607170e1e2b51a

SHA256
e909789af058bf27797dae5a13431f131a9271c9fc0a8365aa521f033f9b0145

SHA512
de8a700641c044066f4a7a46717ffd53a194aaad4d6da4ca51245c8ea73ff93f018945925ae2daa19429e7ceb4c044a47e40ed7bf0117a0081b5d34574180776

Download Submit
C:\Windows\SysWOW64\lgpmlvwd.exe

Filesize
255KB

MD5
22e24f8a47b5f8e976338f8ab9247bcb

SHA1
26a431c04a57a59bb7d3ffba25607170e1e2b51a

SHA256
e909789af058bf27797dae5a13431f131a9271c9fc0a8365aa521f033f9b0145

SHA512
de8a700641c044066f4a7a46717ffd53a194aaad4d6da4ca51245c8ea73ff93f018945925ae2daa19429e7ceb4c044a47e40ed7bf0117a0081b5d34574180776

Download Submit
C:\Windows\SysWOW64\lgpmlvwd.exe

Filesize
255KB

MD5
22e24f8a47b5f8e976338f8ab9247bcb

SHA1
26a431c04a57a59bb7d3ffba25607170e1e2b51a

SHA256
e909789af058bf27797dae5a13431f131a9271c9fc0a8365aa521f033f9b0145

SHA512
de8a700641c044066f4a7a46717ffd53a194aaad4d6da4ca51245c8ea73ff93f018945925ae2daa19429e7ceb4c044a47e40ed7bf0117a0081b5d34574180776

Download Submit
C:\Windows\SysWOW64\ofeeoievkzugc.exe

Filesize
255KB

MD5
85756a3557c3674930c0320b48cfeaf2

SHA1
08d63376c4e6de5d40f1cf270cbbce2b2b0f4c1d

SHA256
a4f030bfe1a4ba483c5bea3a1c6935e81d6e29ce2e111925df596040c327d92f

SHA512
1396b44996e5836429b10e71aa97d650ee23e040d148f7c800579dac5d9993514c94703324e2d87c2b23463b47351f268e762e56aecff445180ac5b98c179761

Download Submit
C:\Windows\SysWOW64\ofeeoievkzugc.exe

Filesize
255KB

MD5
85756a3557c3674930c0320b48cfeaf2

SHA1
08d63376c4e6de5d40f1cf270cbbce2b2b0f4c1d

SHA256
a4f030bfe1a4ba483c5bea3a1c6935e81d6e29ce2e111925df596040c327d92f

SHA512
1396b44996e5836429b10e71aa97d650ee23e040d148f7c800579dac5d9993514c94703324e2d87c2b23463b47351f268e762e56aecff445180ac5b98c179761

Download Submit
C:\Windows\SysWOW64\qagmcscbxw.exe

Filesize
255KB

MD5
5cf0115c2d01ae68044e676c272bbf78

SHA1
3f49db50a4b2c2a0874737232ccf57b050b59c5f

SHA256
b2574ab99f7ff8efb31cfda19ee81ec2b66caa107cae076e98d4787130a06189

SHA512
4af24dc7bb07479b50414cbf21db3be527ddd0663429873aad96a4cb10cd4e0f57dd580f895aacd1cb3ef76e6036efec1ad75947280ca8510dbe79a537d37724

Download Submit
C:\Windows\SysWOW64\qagmcscbxw.exe

Filesize
255KB

MD5
5cf0115c2d01ae68044e676c272bbf78

SHA1
3f49db50a4b2c2a0874737232ccf57b050b59c5f

SHA256
b2574ab99f7ff8efb31cfda19ee81ec2b66caa107cae076e98d4787130a06189

SHA512
4af24dc7bb07479b50414cbf21db3be527ddd0663429873aad96a4cb10cd4e0f57dd580f895aacd1cb3ef76e6036efec1ad75947280ca8510dbe79a537d37724

Download Submit
C:\Windows\SysWOW64\tueqhitztjhrtll.exe

Filesize
255KB

MD5
4c52ec6b4447e7c09233cdb7d2ceb3ac

SHA1
7451f7a165c1be923ff63e9fefd855ebe8b92ee5

SHA256
2259df57d29967a76cc24f85c0647230be193ad849f39f5a4aa44e074124fa37

SHA512
0210cfb8d76b26b32acb03d8d288962d25f39022fcd0bb0ef71cf85467d12901985a5f13ee90e600dcda22e92cc0c7fe181ce2e0a37470b0e252cc30e30267e1

Download Submit
C:\Windows\SysWOW64\tueqhitztjhrtll.exe

Filesize
255KB

MD5
4c52ec6b4447e7c09233cdb7d2ceb3ac

SHA1
7451f7a165c1be923ff63e9fefd855ebe8b92ee5

SHA256
2259df57d29967a76cc24f85c0647230be193ad849f39f5a4aa44e074124fa37

SHA512
0210cfb8d76b26b32acb03d8d288962d25f39022fcd0bb0ef71cf85467d12901985a5f13ee90e600dcda22e92cc0c7fe181ce2e0a37470b0e252cc30e30267e1

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\lgpmlvwd.exe

Filesize
255KB

MD5
22e24f8a47b5f8e976338f8ab9247bcb

SHA1
26a431c04a57a59bb7d3ffba25607170e1e2b51a

SHA256
e909789af058bf27797dae5a13431f131a9271c9fc0a8365aa521f033f9b0145

SHA512
de8a700641c044066f4a7a46717ffd53a194aaad4d6da4ca51245c8ea73ff93f018945925ae2daa19429e7ceb4c044a47e40ed7bf0117a0081b5d34574180776

Download Submit
\Windows\SysWOW64\lgpmlvwd.exe

Filesize
255KB

MD5
22e24f8a47b5f8e976338f8ab9247bcb

SHA1
26a431c04a57a59bb7d3ffba25607170e1e2b51a

SHA256
e909789af058bf27797dae5a13431f131a9271c9fc0a8365aa521f033f9b0145

SHA512
de8a700641c044066f4a7a46717ffd53a194aaad4d6da4ca51245c8ea73ff93f018945925ae2daa19429e7ceb4c044a47e40ed7bf0117a0081b5d34574180776

Download Submit
\Windows\SysWOW64\ofeeoievkzugc.exe

Filesize
255KB

MD5
85756a3557c3674930c0320b48cfeaf2

SHA1
08d63376c4e6de5d40f1cf270cbbce2b2b0f4c1d

SHA256
a4f030bfe1a4ba483c5bea3a1c6935e81d6e29ce2e111925df596040c327d92f

SHA512
1396b44996e5836429b10e71aa97d650ee23e040d148f7c800579dac5d9993514c94703324e2d87c2b23463b47351f268e762e56aecff445180ac5b98c179761

Download Submit
\Windows\SysWOW64\qagmcscbxw.exe

Filesize
255KB

MD5
5cf0115c2d01ae68044e676c272bbf78

SHA1
3f49db50a4b2c2a0874737232ccf57b050b59c5f

SHA256
b2574ab99f7ff8efb31cfda19ee81ec2b66caa107cae076e98d4787130a06189

SHA512
4af24dc7bb07479b50414cbf21db3be527ddd0663429873aad96a4cb10cd4e0f57dd580f895aacd1cb3ef76e6036efec1ad75947280ca8510dbe79a537d37724

Download Submit
\Windows\SysWOW64\tueqhitztjhrtll.exe

Filesize
255KB

MD5
4c52ec6b4447e7c09233cdb7d2ceb3ac

SHA1
7451f7a165c1be923ff63e9fefd855ebe8b92ee5

SHA256
2259df57d29967a76cc24f85c0647230be193ad849f39f5a4aa44e074124fa37

SHA512
0210cfb8d76b26b32acb03d8d288962d25f39022fcd0bb0ef71cf85467d12901985a5f13ee90e600dcda22e92cc0c7fe181ce2e0a37470b0e252cc30e30267e1

Download Submit
memory/360-101-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/360-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/360-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/560-104-0x000007FEFB5E1000-0x000007FEFB5E3000-memory.dmp

Filesize
8KB

Download
memory/1224-108-0x0000000070B6D000-0x0000000070B78000-memory.dmp

Filesize
44KB

Download
memory/1224-107-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1224-88-0x0000000072101000-0x0000000072104000-memory.dmp

Filesize
12KB

Download
memory/1224-89-0x000000006FB81000-0x000000006FB83000-memory.dmp

Filesize
8KB

Download
memory/1224-90-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1224-92-0x0000000070B6D000-0x0000000070B78000-memory.dmp

Filesize
44KB

Download
memory/1224-102-0x0000000070B6D000-0x0000000070B78000-memory.dmp

Filesize
44KB

Download
memory/1456-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1456-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1456-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1456-80-0x00000000032F0000-0x0000000003390000-memory.dmp

Filesize
640KB

Download
memory/1616-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1616-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-105-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1684-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1684-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1704-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1704-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download