f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1

Analysis

max time kernel
150s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
Size

255KB
MD5

cc7af66cbf75ec24dfd790cb33743f81
SHA1

47dbb042e55dc2bc1ab2f6236cd2644e23d5f1e7
SHA256

f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1
SHA512

045753b5af1660ce7afe898da9af9dc0fef8e2e9c7f401f5b4a85326f4a376a691fb66e8c246b40ac0880735351a5d33dfa667519db888f9d96448fad0a66c48
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJB:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIQ

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	rgdbuzmdog.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rgdbuzmdog.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rgdbuzmdog.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	rgdbuzmdog.exe

Executes dropped EXE 6 IoCs

pid	Process
1968	rgdbuzmdog.exe
556	xihwcngharmqsdx.exe
1484	najxhkou.exe
592	qijsbsvgjdknx.exe
1624	najxhkou.exe
1600	qijsbsvgjdknx.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000000b2d2-55.dat	upx
behavioral1/files/0x000b0000000122eb-58.dat	upx
behavioral1/files/0x000500000000b2d2-57.dat	upx
behavioral1/files/0x000b0000000122eb-61.dat	upx
behavioral1/files/0x00090000000122f9-63.dat	upx
behavioral1/files/0x00080000000122fd-73.dat	upx
behavioral1/files/0x000b0000000122eb-67.dat	upx
behavioral1/files/0x00080000000122fd-71.dat	upx
behavioral1/files/0x00090000000122f9-66.dat	upx
behavioral1/files/0x00080000000122fd-68.dat	upx
behavioral1/files/0x000500000000b2d2-65.dat	upx
behavioral1/files/0x00090000000122f9-74.dat	upx
behavioral1/files/0x00090000000122f9-76.dat	upx
behavioral1/files/0x00090000000122f9-78.dat	upx
behavioral1/files/0x00080000000122fd-80.dat	upx
behavioral1/files/0x00080000000122fd-82.dat	upx
behavioral1/memory/1720-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1968-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/556-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1484-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/592-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1600-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1624-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1720-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0008000000012318-100.dat	upx
behavioral1/files/0x00070000000126a6-103.dat	upx
behavioral1/files/0x00070000000126a6-104.dat	upx
behavioral1/files/0x00070000000126c8-105.dat	upx
behavioral1/memory/1968-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1484-108-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/592-109-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1600-111-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1624-110-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/556-107-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1624-113-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1484-114-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1968	rgdbuzmdog.exe
1316	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	rgdbuzmdog.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	xihwcngharmqsdx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\skbypmqf = "rgdbuzmdog.exe"	xihwcngharmqsdx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\rxhhieso = "xihwcngharmqsdx.exe"	xihwcngharmqsdx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "qijsbsvgjdknx.exe"	xihwcngharmqsdx.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	najxhkou.exe
File opened (read-only)	\??\m:	rgdbuzmdog.exe
File opened (read-only)	\??\n:	najxhkou.exe
File opened (read-only)	\??\r:	najxhkou.exe
File opened (read-only)	\??\r:	najxhkou.exe
File opened (read-only)	\??\l:	rgdbuzmdog.exe
File opened (read-only)	\??\o:	rgdbuzmdog.exe
File opened (read-only)	\??\x:	rgdbuzmdog.exe
File opened (read-only)	\??\b:	najxhkou.exe
File opened (read-only)	\??\m:	najxhkou.exe
File opened (read-only)	\??\h:	rgdbuzmdog.exe
File opened (read-only)	\??\i:	najxhkou.exe
File opened (read-only)	\??\m:	najxhkou.exe
File opened (read-only)	\??\e:	najxhkou.exe
File opened (read-only)	\??\b:	rgdbuzmdog.exe
File opened (read-only)	\??\s:	rgdbuzmdog.exe
File opened (read-only)	\??\a:	rgdbuzmdog.exe
File opened (read-only)	\??\v:	rgdbuzmdog.exe
File opened (read-only)	\??\g:	najxhkou.exe
File opened (read-only)	\??\f:	rgdbuzmdog.exe
File opened (read-only)	\??\u:	rgdbuzmdog.exe
File opened (read-only)	\??\f:	najxhkou.exe
File opened (read-only)	\??\g:	najxhkou.exe
File opened (read-only)	\??\k:	najxhkou.exe
File opened (read-only)	\??\e:	rgdbuzmdog.exe
File opened (read-only)	\??\q:	najxhkou.exe
File opened (read-only)	\??\h:	najxhkou.exe
File opened (read-only)	\??\v:	najxhkou.exe
File opened (read-only)	\??\w:	najxhkou.exe
File opened (read-only)	\??\y:	najxhkou.exe
File opened (read-only)	\??\i:	najxhkou.exe
File opened (read-only)	\??\l:	najxhkou.exe
File opened (read-only)	\??\n:	rgdbuzmdog.exe
File opened (read-only)	\??\x:	najxhkou.exe
File opened (read-only)	\??\y:	rgdbuzmdog.exe
File opened (read-only)	\??\o:	najxhkou.exe
File opened (read-only)	\??\k:	rgdbuzmdog.exe
File opened (read-only)	\??\p:	rgdbuzmdog.exe
File opened (read-only)	\??\a:	najxhkou.exe
File opened (read-only)	\??\l:	najxhkou.exe
File opened (read-only)	\??\p:	najxhkou.exe
File opened (read-only)	\??\a:	najxhkou.exe
File opened (read-only)	\??\u:	najxhkou.exe
File opened (read-only)	\??\i:	rgdbuzmdog.exe
File opened (read-only)	\??\s:	najxhkou.exe
File opened (read-only)	\??\b:	najxhkou.exe
File opened (read-only)	\??\x:	najxhkou.exe
File opened (read-only)	\??\z:	najxhkou.exe
File opened (read-only)	\??\z:	najxhkou.exe
File opened (read-only)	\??\f:	najxhkou.exe
File opened (read-only)	\??\j:	najxhkou.exe
File opened (read-only)	\??\w:	rgdbuzmdog.exe
File opened (read-only)	\??\z:	rgdbuzmdog.exe
File opened (read-only)	\??\h:	najxhkou.exe
File opened (read-only)	\??\u:	najxhkou.exe
File opened (read-only)	\??\v:	najxhkou.exe
File opened (read-only)	\??\n:	najxhkou.exe
File opened (read-only)	\??\q:	najxhkou.exe
File opened (read-only)	\??\r:	rgdbuzmdog.exe
File opened (read-only)	\??\k:	najxhkou.exe
File opened (read-only)	\??\t:	najxhkou.exe
File opened (read-only)	\??\w:	najxhkou.exe
File opened (read-only)	\??\p:	najxhkou.exe
File opened (read-only)	\??\q:	rgdbuzmdog.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	rgdbuzmdog.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	rgdbuzmdog.exe

AutoIT Executable 16 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1720-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1968-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/556-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1484-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/592-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1600-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1624-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1720-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1968-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1484-108-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/592-109-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1600-111-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1624-110-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/556-107-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1624-113-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1484-114-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xihwcngharmqsdx.exe	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
File created	C:\Windows\SysWOW64\najxhkou.exe	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
File created	C:\Windows\SysWOW64\qijsbsvgjdknx.exe	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	rgdbuzmdog.exe
File created	C:\Windows\SysWOW64\rgdbuzmdog.exe	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
File opened for modification	C:\Windows\SysWOW64\rgdbuzmdog.exe	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
File opened for modification	C:\Windows\SysWOW64\xihwcngharmqsdx.exe	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
File opened for modification	C:\Windows\SysWOW64\najxhkou.exe	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
File opened for modification	C:\Windows\SysWOW64\qijsbsvgjdknx.exe	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe

Drops file in Program Files directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\RestoreCopy.nal	najxhkou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	najxhkou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	najxhkou.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	najxhkou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	najxhkou.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	najxhkou.exe
File opened for modification	\??\c:\Program Files\RestoreCopy.doc.exe	najxhkou.exe
File opened for modification	C:\Program Files\RestoreCopy.doc.exe	najxhkou.exe
File opened for modification	\??\c:\Program Files\RestoreCopy.doc.exe	najxhkou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	najxhkou.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	najxhkou.exe
File created	\??\c:\Program Files\RestoreCopy.doc.exe	najxhkou.exe
File opened for modification	C:\Program Files\RestoreCopy.nal	najxhkou.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	najxhkou.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	najxhkou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	najxhkou.exe
File opened for modification	C:\Program Files\RestoreCopy.doc.exe	najxhkou.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	najxhkou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	najxhkou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	najxhkou.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	najxhkou.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	rgdbuzmdog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	rgdbuzmdog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F26BC5FE6622D1D10BD0A38B789117"	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	rgdbuzmdog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	rgdbuzmdog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1939C7791593DAB3B8CD7CE1ECE434C6"	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	rgdbuzmdog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F89FF8E482A82129141D65D7E93BD95E141594367356330D69C"	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1792	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
556	xihwcngharmqsdx.exe
556	xihwcngharmqsdx.exe
556	xihwcngharmqsdx.exe
556	xihwcngharmqsdx.exe
1968	rgdbuzmdog.exe
1968	rgdbuzmdog.exe
1968	rgdbuzmdog.exe
1968	rgdbuzmdog.exe
1968	rgdbuzmdog.exe
556	xihwcngharmqsdx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
1484	najxhkou.exe
1484	najxhkou.exe
1484	najxhkou.exe
1484	najxhkou.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1624	najxhkou.exe
1624	najxhkou.exe
1624	najxhkou.exe
1624	najxhkou.exe
556	xihwcngharmqsdx.exe
556	xihwcngharmqsdx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
556	xihwcngharmqsdx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
556	xihwcngharmqsdx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
556	xihwcngharmqsdx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
556	xihwcngharmqsdx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1516	explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe
Token: 33	576	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	576	AUDIODG.EXE
Token: 33	576	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	576	AUDIODG.EXE
Token: SeShutdownPrivilege	1516	explorer.exe
Token: SeShutdownPrivilege	1516	explorer.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1968	rgdbuzmdog.exe
1968	rgdbuzmdog.exe
1968	rgdbuzmdog.exe
556	xihwcngharmqsdx.exe
556	xihwcngharmqsdx.exe
556	xihwcngharmqsdx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
1484	najxhkou.exe
1484	najxhkou.exe
1484	najxhkou.exe
1624	najxhkou.exe
1624	najxhkou.exe
1624	najxhkou.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1600	qijsbsvgjdknx.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
1968	rgdbuzmdog.exe
1968	rgdbuzmdog.exe
1968	rgdbuzmdog.exe
556	xihwcngharmqsdx.exe
556	xihwcngharmqsdx.exe
556	xihwcngharmqsdx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
592	qijsbsvgjdknx.exe
1484	najxhkou.exe
1484	najxhkou.exe
1484	najxhkou.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe
1516	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1792	WINWORD.EXE
1792	WINWORD.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1968	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	27
PID 1720 wrote to memory of 1968	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	27
PID 1720 wrote to memory of 1968	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	27
PID 1720 wrote to memory of 1968	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	27
PID 1720 wrote to memory of 556	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	28
PID 1720 wrote to memory of 556	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	28
PID 1720 wrote to memory of 556	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	28
PID 1720 wrote to memory of 556	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	28
PID 1720 wrote to memory of 1484	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	29
PID 1720 wrote to memory of 1484	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	29
PID 1720 wrote to memory of 1484	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	29
PID 1720 wrote to memory of 1484	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	29
PID 1720 wrote to memory of 592	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	30
PID 1720 wrote to memory of 592	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	30
PID 1720 wrote to memory of 592	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	30
PID 1720 wrote to memory of 592	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	30
PID 556 wrote to memory of 1316	556	xihwcngharmqsdx.exe	31
PID 556 wrote to memory of 1316	556	xihwcngharmqsdx.exe	31
PID 556 wrote to memory of 1316	556	xihwcngharmqsdx.exe	31
PID 556 wrote to memory of 1316	556	xihwcngharmqsdx.exe	31
PID 1968 wrote to memory of 1624	1968	rgdbuzmdog.exe	33
PID 1968 wrote to memory of 1624	1968	rgdbuzmdog.exe	33
PID 1968 wrote to memory of 1624	1968	rgdbuzmdog.exe	33
PID 1968 wrote to memory of 1624	1968	rgdbuzmdog.exe	33
PID 1316 wrote to memory of 1600	1316	cmd.exe	34
PID 1316 wrote to memory of 1600	1316	cmd.exe	34
PID 1316 wrote to memory of 1600	1316	cmd.exe	34
PID 1316 wrote to memory of 1600	1316	cmd.exe	34
PID 1720 wrote to memory of 1792	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	35
PID 1720 wrote to memory of 1792	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	35
PID 1720 wrote to memory of 1792	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	35
PID 1720 wrote to memory of 1792	1720	f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe	35

C:\Users\Admin\AppData\Local\Temp\f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe
"C:\Users\Admin\AppData\Local\Temp\f11246633416d282b130e0f592ed50c9514bc6d2cf80e73d53daa26d477281a1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\rgdbuzmdog.exe
  rgdbuzmdog.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\najxhkou.exe
    C:\Windows\system32\najxhkou.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:1624
- C:\Windows\SysWOW64\xihwcngharmqsdx.exe
  xihwcngharmqsdx.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c qijsbsvgjdknx.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\SysWOW64\qijsbsvgjdknx.exe
      qijsbsvgjdknx.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:1600
- C:\Windows\SysWOW64\najxhkou.exe
  najxhkou.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1484
- C:\Windows\SysWOW64\qijsbsvgjdknx.exe
  qijsbsvgjdknx.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:592
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1792

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1516

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
349a1cc448b8183d59e9e70237f4f3ad

SHA1
54035e17cfa9cdb679f1cb99329f880f2b344950

SHA256
f7994c83cc6ba8e487d47dbf4802776d0481abe3def36d469461235690908b6c

SHA512
8d2a4820c3b53233f6acae26082354daa65730896408dc0b609e40417e369b4d6ab21e3e3cd6c97debc3e08da5f4b9c191d4a86a5d8e0258c6b26e6115cb9238

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
349a1cc448b8183d59e9e70237f4f3ad

SHA1
54035e17cfa9cdb679f1cb99329f880f2b344950

SHA256
f7994c83cc6ba8e487d47dbf4802776d0481abe3def36d469461235690908b6c

SHA512
8d2a4820c3b53233f6acae26082354daa65730896408dc0b609e40417e369b4d6ab21e3e3cd6c97debc3e08da5f4b9c191d4a86a5d8e0258c6b26e6115cb9238

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
c851c07053b7d569499554bb886cec7c

SHA1
c92ab85b6b91472372a3e8d8d5fa20d8eb810a28

SHA256
57ca34de95752308940093ec53db9390464d51673789c12d119bd8a4c1d4c2cc

SHA512
7bd7cb9c2ae977193f1d24458b0d43a2184493e8ff854a6b8d1df3aecc8c036f2c6b82248714b8098adc1c859cd5bddddea339320f6fbd69fbb7b6f032f94cbb

Download Submit
C:\Program Files\RestoreCopy.doc.exe

Filesize
255KB

MD5
7a332799a497bb16d804e45b1a2859cb

SHA1
970e7e77b11735e5975ab3ea0c939902c4698d86

SHA256
9b9a68875f46312d8c45e326d865fb9ea1cadc39e817870b19745f340ecf3fba

SHA512
6c044aa5144bc20d91a260f2c085eff87c1dd6f21a01ac6c513202b4d44db2cb96bf69a6fe525feb6ac19b3169bf3edf2fae32a52306ce31c577b7f52b4a48e7

Download Submit
C:\Windows\SysWOW64\najxhkou.exe

Filesize
255KB

MD5
29ae47ea45951b0e3f052dfa1f752895

SHA1
23785c296158ce7abffecc54721a9131f03e9e46

SHA256
37e33394dfea748c82d49b2ba2b83fc8bebd448963e516abad6aa8125508c345

SHA512
031f8a768cca054346a3e7b8cdd3d7440fe20205b7baf1bd9c667daac2aecac3c90004af44fe9b3713d4f6c74b121bc9c947ef60d1bea01eeede296f1133bf7e

Download Submit
C:\Windows\SysWOW64\najxhkou.exe

Filesize
255KB

MD5
29ae47ea45951b0e3f052dfa1f752895

SHA1
23785c296158ce7abffecc54721a9131f03e9e46

SHA256
37e33394dfea748c82d49b2ba2b83fc8bebd448963e516abad6aa8125508c345

SHA512
031f8a768cca054346a3e7b8cdd3d7440fe20205b7baf1bd9c667daac2aecac3c90004af44fe9b3713d4f6c74b121bc9c947ef60d1bea01eeede296f1133bf7e

Download Submit
C:\Windows\SysWOW64\najxhkou.exe

Filesize
255KB

MD5
29ae47ea45951b0e3f052dfa1f752895

SHA1
23785c296158ce7abffecc54721a9131f03e9e46

SHA256
37e33394dfea748c82d49b2ba2b83fc8bebd448963e516abad6aa8125508c345

SHA512
031f8a768cca054346a3e7b8cdd3d7440fe20205b7baf1bd9c667daac2aecac3c90004af44fe9b3713d4f6c74b121bc9c947ef60d1bea01eeede296f1133bf7e

Download Submit
C:\Windows\SysWOW64\qijsbsvgjdknx.exe

Filesize
255KB

MD5
c703c0fee92dd71a803efff321fe03a6

SHA1
f71446526fcce265d54f78df694474d6de984195

SHA256
547abda5b200e457c9cfc94af0b66dc1eb584d51b81b62f2da6af4200d426bef

SHA512
1ae32338eb8e217fdf2d7d277c872ad3cb39d2396fb6a7460bb5ed403bb3dd18a9493cf62f4acad5c3449afad33f6999c6f83fc688f480ac32e8e06184904510

Download Submit
C:\Windows\SysWOW64\qijsbsvgjdknx.exe

Filesize
255KB

MD5
c703c0fee92dd71a803efff321fe03a6

SHA1
f71446526fcce265d54f78df694474d6de984195

SHA256
547abda5b200e457c9cfc94af0b66dc1eb584d51b81b62f2da6af4200d426bef

SHA512
1ae32338eb8e217fdf2d7d277c872ad3cb39d2396fb6a7460bb5ed403bb3dd18a9493cf62f4acad5c3449afad33f6999c6f83fc688f480ac32e8e06184904510

Download Submit
C:\Windows\SysWOW64\qijsbsvgjdknx.exe

Filesize
255KB

MD5
c703c0fee92dd71a803efff321fe03a6

SHA1
f71446526fcce265d54f78df694474d6de984195

SHA256
547abda5b200e457c9cfc94af0b66dc1eb584d51b81b62f2da6af4200d426bef

SHA512
1ae32338eb8e217fdf2d7d277c872ad3cb39d2396fb6a7460bb5ed403bb3dd18a9493cf62f4acad5c3449afad33f6999c6f83fc688f480ac32e8e06184904510

Download Submit
C:\Windows\SysWOW64\rgdbuzmdog.exe

Filesize
255KB

MD5
7bfd01b6081906388b1f01a2c8420218

SHA1
7efad70ca88fd77fc9206289ac25b87915c92868

SHA256
fe581245019094fe30b6673e55cec89fa0ef119df644fa38e800eabf8c7bcd6c

SHA512
efd79d97c74832468defe02e7ccc521df6539ef0434cb1fd7b0666cb016673567805ab4d90fb038e9af844eb693e8568bb816414c11a575416fb044453bb23d9

Download Submit
C:\Windows\SysWOW64\rgdbuzmdog.exe

Filesize
255KB

MD5
7bfd01b6081906388b1f01a2c8420218

SHA1
7efad70ca88fd77fc9206289ac25b87915c92868

SHA256
fe581245019094fe30b6673e55cec89fa0ef119df644fa38e800eabf8c7bcd6c

SHA512
efd79d97c74832468defe02e7ccc521df6539ef0434cb1fd7b0666cb016673567805ab4d90fb038e9af844eb693e8568bb816414c11a575416fb044453bb23d9

Download Submit
C:\Windows\SysWOW64\xihwcngharmqsdx.exe

Filesize
255KB

MD5
a018036c4ef382f6e00bda8d9eda9b5e

SHA1
e07d25a61e2559f284689d4233db03564d6be654

SHA256
28edcb1bd8fd61c3b993810261a399152068df19efb81b7f7a85b459c185510e

SHA512
9f5f25e0efbf57f994d1c333a42ce0065ed1a8ee3b710353523e3add17352b7ac95350391f944946be223acc6024b37d277fbf6fb1d23c4826af70c399c5a0ed

Download Submit
C:\Windows\SysWOW64\xihwcngharmqsdx.exe

Filesize
255KB

MD5
a018036c4ef382f6e00bda8d9eda9b5e

SHA1
e07d25a61e2559f284689d4233db03564d6be654

SHA256
28edcb1bd8fd61c3b993810261a399152068df19efb81b7f7a85b459c185510e

SHA512
9f5f25e0efbf57f994d1c333a42ce0065ed1a8ee3b710353523e3add17352b7ac95350391f944946be223acc6024b37d277fbf6fb1d23c4826af70c399c5a0ed

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\najxhkou.exe

Filesize
255KB

MD5
29ae47ea45951b0e3f052dfa1f752895

SHA1
23785c296158ce7abffecc54721a9131f03e9e46

SHA256
37e33394dfea748c82d49b2ba2b83fc8bebd448963e516abad6aa8125508c345

SHA512
031f8a768cca054346a3e7b8cdd3d7440fe20205b7baf1bd9c667daac2aecac3c90004af44fe9b3713d4f6c74b121bc9c947ef60d1bea01eeede296f1133bf7e

Download Submit
\Windows\SysWOW64\najxhkou.exe

Filesize
255KB

MD5
29ae47ea45951b0e3f052dfa1f752895

SHA1
23785c296158ce7abffecc54721a9131f03e9e46

SHA256
37e33394dfea748c82d49b2ba2b83fc8bebd448963e516abad6aa8125508c345

SHA512
031f8a768cca054346a3e7b8cdd3d7440fe20205b7baf1bd9c667daac2aecac3c90004af44fe9b3713d4f6c74b121bc9c947ef60d1bea01eeede296f1133bf7e

Download Submit
\Windows\SysWOW64\qijsbsvgjdknx.exe

Filesize
255KB

MD5
c703c0fee92dd71a803efff321fe03a6

SHA1
f71446526fcce265d54f78df694474d6de984195

SHA256
547abda5b200e457c9cfc94af0b66dc1eb584d51b81b62f2da6af4200d426bef

SHA512
1ae32338eb8e217fdf2d7d277c872ad3cb39d2396fb6a7460bb5ed403bb3dd18a9493cf62f4acad5c3449afad33f6999c6f83fc688f480ac32e8e06184904510

Download Submit
\Windows\SysWOW64\qijsbsvgjdknx.exe

Filesize
255KB

MD5
c703c0fee92dd71a803efff321fe03a6

SHA1
f71446526fcce265d54f78df694474d6de984195

SHA256
547abda5b200e457c9cfc94af0b66dc1eb584d51b81b62f2da6af4200d426bef

SHA512
1ae32338eb8e217fdf2d7d277c872ad3cb39d2396fb6a7460bb5ed403bb3dd18a9493cf62f4acad5c3449afad33f6999c6f83fc688f480ac32e8e06184904510

Download Submit
\Windows\SysWOW64\rgdbuzmdog.exe

Filesize
255KB

MD5
7bfd01b6081906388b1f01a2c8420218

SHA1
7efad70ca88fd77fc9206289ac25b87915c92868

SHA256
fe581245019094fe30b6673e55cec89fa0ef119df644fa38e800eabf8c7bcd6c

SHA512
efd79d97c74832468defe02e7ccc521df6539ef0434cb1fd7b0666cb016673567805ab4d90fb038e9af844eb693e8568bb816414c11a575416fb044453bb23d9

Download Submit
\Windows\SysWOW64\xihwcngharmqsdx.exe

Filesize
255KB

MD5
a018036c4ef382f6e00bda8d9eda9b5e

SHA1
e07d25a61e2559f284689d4233db03564d6be654

SHA256
28edcb1bd8fd61c3b993810261a399152068df19efb81b7f7a85b459c185510e

SHA512
9f5f25e0efbf57f994d1c333a42ce0065ed1a8ee3b710353523e3add17352b7ac95350391f944946be223acc6024b37d277fbf6fb1d23c4826af70c399c5a0ed

Download Submit
memory/556-107-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/556-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/592-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/592-109-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1484-114-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1484-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1484-108-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1516-115-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/1516-102-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download
memory/1600-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1600-111-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1624-113-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1624-110-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1624-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1720-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/1720-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1720-85-0x0000000002EB0000-0x0000000002F50000-memory.dmp

Filesize
640KB

Download
memory/1720-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1792-95-0x0000000072B01000-0x0000000072B04000-memory.dmp

Filesize
12KB

Download
memory/1792-101-0x000000007156D000-0x0000000071578000-memory.dmp

Filesize
44KB

Download
memory/1792-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1792-96-0x0000000070581000-0x0000000070583000-memory.dmp

Filesize
8KB

Download
memory/1792-112-0x000000007156D000-0x0000000071578000-memory.dmp

Filesize
44KB

Download
memory/1968-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1968-90-0x0000000003890000-0x0000000003930000-memory.dmp

Filesize
640KB

Download
memory/1968-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download