a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
Size

255KB
MD5

e88d07d695a80c20a9e381b2612eb298
SHA1

f7d5c373bd44c95caab84f7ffa49dfec868f6ec3
SHA256

a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806
SHA512

00b76153cc182b5cf410aa1ec9452f4d871425e5440d21d48e15c8f4307f3e49d515703a36b370af29e66cdaca68de795a588912e16ba6d5ea14623c0d207b14
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJg:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIb

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ntxntvsnbu.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ntxntvsnbu.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ntxntvsnbu.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ntxntvsnbu.exe

Executes dropped EXE 5 IoCs

pid	Process
1788	ntxntvsnbu.exe
1336	rxynsqwcdguihmr.exe
2036	otqgyknv.exe
1096	cvapnccymjfjr.exe
1980	otqgyknv.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000054a8-55.dat	upx
behavioral1/files/0x000c0000000054a8-57.dat	upx
behavioral1/files/0x000c0000000054a8-59.dat	upx
behavioral1/files/0x000a0000000139f2-60.dat	upx
behavioral1/files/0x000a0000000139f2-62.dat	upx
behavioral1/files/0x000700000001411f-63.dat	upx
behavioral1/files/0x000700000001411f-65.dat	upx
behavioral1/files/0x000600000001413c-68.dat	upx
behavioral1/files/0x000600000001413c-70.dat	upx
behavioral1/files/0x000a0000000139f2-71.dat	upx
behavioral1/files/0x000700000001411f-72.dat	upx
behavioral1/files/0x000600000001413c-74.dat	upx
behavioral1/memory/832-75-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1788-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1336-78-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2036-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1096-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x000700000001411f-81.dat	upx
behavioral1/files/0x000700000001411f-83.dat	upx
behavioral1/memory/832-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1980-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1788-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2036-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1096-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1336-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1980-101-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00060000000149ab-106.dat	upx
behavioral1/files/0x00060000000149ab-105.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
1788	ntxntvsnbu.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ntxntvsnbu.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	rxynsqwcdguihmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zxdylmep = "ntxntvsnbu.exe"	rxynsqwcdguihmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kwgwlekv = "rxynsqwcdguihmr.exe"	rxynsqwcdguihmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "cvapnccymjfjr.exe"	rxynsqwcdguihmr.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	otqgyknv.exe
File opened (read-only)	\??\f:	otqgyknv.exe
File opened (read-only)	\??\p:	ntxntvsnbu.exe
File opened (read-only)	\??\s:	ntxntvsnbu.exe
File opened (read-only)	\??\g:	otqgyknv.exe
File opened (read-only)	\??\o:	otqgyknv.exe
File opened (read-only)	\??\p:	otqgyknv.exe
File opened (read-only)	\??\n:	otqgyknv.exe
File opened (read-only)	\??\h:	ntxntvsnbu.exe
File opened (read-only)	\??\i:	ntxntvsnbu.exe
File opened (read-only)	\??\q:	ntxntvsnbu.exe
File opened (read-only)	\??\q:	otqgyknv.exe
File opened (read-only)	\??\z:	otqgyknv.exe
File opened (read-only)	\??\a:	otqgyknv.exe
File opened (read-only)	\??\a:	otqgyknv.exe
File opened (read-only)	\??\j:	otqgyknv.exe
File opened (read-only)	\??\r:	otqgyknv.exe
File opened (read-only)	\??\t:	otqgyknv.exe
File opened (read-only)	\??\v:	otqgyknv.exe
File opened (read-only)	\??\b:	ntxntvsnbu.exe
File opened (read-only)	\??\f:	otqgyknv.exe
File opened (read-only)	\??\u:	otqgyknv.exe
File opened (read-only)	\??\x:	otqgyknv.exe
File opened (read-only)	\??\y:	otqgyknv.exe
File opened (read-only)	\??\m:	ntxntvsnbu.exe
File opened (read-only)	\??\n:	otqgyknv.exe
File opened (read-only)	\??\o:	ntxntvsnbu.exe
File opened (read-only)	\??\v:	ntxntvsnbu.exe
File opened (read-only)	\??\r:	otqgyknv.exe
File opened (read-only)	\??\r:	ntxntvsnbu.exe
File opened (read-only)	\??\u:	ntxntvsnbu.exe
File opened (read-only)	\??\z:	ntxntvsnbu.exe
File opened (read-only)	\??\j:	otqgyknv.exe
File opened (read-only)	\??\k:	otqgyknv.exe
File opened (read-only)	\??\l:	otqgyknv.exe
File opened (read-only)	\??\i:	otqgyknv.exe
File opened (read-only)	\??\p:	otqgyknv.exe
File opened (read-only)	\??\y:	otqgyknv.exe
File opened (read-only)	\??\b:	otqgyknv.exe
File opened (read-only)	\??\k:	otqgyknv.exe
File opened (read-only)	\??\t:	ntxntvsnbu.exe
File opened (read-only)	\??\x:	ntxntvsnbu.exe
File opened (read-only)	\??\h:	otqgyknv.exe
File opened (read-only)	\??\v:	otqgyknv.exe
File opened (read-only)	\??\g:	otqgyknv.exe
File opened (read-only)	\??\l:	otqgyknv.exe
File opened (read-only)	\??\x:	otqgyknv.exe
File opened (read-only)	\??\f:	ntxntvsnbu.exe
File opened (read-only)	\??\e:	otqgyknv.exe
File opened (read-only)	\??\w:	otqgyknv.exe
File opened (read-only)	\??\j:	ntxntvsnbu.exe
File opened (read-only)	\??\l:	ntxntvsnbu.exe
File opened (read-only)	\??\b:	otqgyknv.exe
File opened (read-only)	\??\e:	otqgyknv.exe
File opened (read-only)	\??\m:	otqgyknv.exe
File opened (read-only)	\??\a:	ntxntvsnbu.exe
File opened (read-only)	\??\t:	otqgyknv.exe
File opened (read-only)	\??\q:	otqgyknv.exe
File opened (read-only)	\??\e:	ntxntvsnbu.exe
File opened (read-only)	\??\y:	ntxntvsnbu.exe
File opened (read-only)	\??\u:	otqgyknv.exe
File opened (read-only)	\??\w:	ntxntvsnbu.exe
File opened (read-only)	\??\m:	otqgyknv.exe
File opened (read-only)	\??\w:	otqgyknv.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	ntxntvsnbu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	ntxntvsnbu.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/832-75-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1788-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1336-78-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2036-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1096-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/832-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1980-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1788-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2036-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1096-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1336-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1980-101-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rxynsqwcdguihmr.exe	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
File created	C:\Windows\SysWOW64\cvapnccymjfjr.exe	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
File opened for modification	C:\Windows\SysWOW64\cvapnccymjfjr.exe	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	ntxntvsnbu.exe
File created	C:\Windows\SysWOW64\ntxntvsnbu.exe	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
File opened for modification	C:\Windows\SysWOW64\ntxntvsnbu.exe	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
File created	C:\Windows\SysWOW64\rxynsqwcdguihmr.exe	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
File created	C:\Windows\SysWOW64\otqgyknv.exe	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
File opened for modification	C:\Windows\SysWOW64\otqgyknv.exe	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	otqgyknv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	otqgyknv.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	otqgyknv.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	otqgyknv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	otqgyknv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	otqgyknv.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	otqgyknv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	otqgyknv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	otqgyknv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	otqgyknv.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	otqgyknv.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	otqgyknv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	otqgyknv.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	otqgyknv.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	ntxntvsnbu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	ntxntvsnbu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	ntxntvsnbu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC70F15E5DBC7B8C87CE1ED9537CF"	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	ntxntvsnbu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33342D7C9D2183516D4177D677252CA97DF565DC"	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
364	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
1788	ntxntvsnbu.exe
1788	ntxntvsnbu.exe
1788	ntxntvsnbu.exe
1788	ntxntvsnbu.exe
1788	ntxntvsnbu.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
2036	otqgyknv.exe
2036	otqgyknv.exe
2036	otqgyknv.exe
2036	otqgyknv.exe
1336	rxynsqwcdguihmr.exe
1336	rxynsqwcdguihmr.exe
1336	rxynsqwcdguihmr.exe
1336	rxynsqwcdguihmr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1980	otqgyknv.exe
1980	otqgyknv.exe
1980	otqgyknv.exe
1980	otqgyknv.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: 33	1552	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1552	AUDIODG.EXE
Token: 33	1552	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1552	AUDIODG.EXE
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe
Token: SeShutdownPrivilege	816	explorer.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
1788	ntxntvsnbu.exe
1788	ntxntvsnbu.exe
1788	ntxntvsnbu.exe
2036	otqgyknv.exe
2036	otqgyknv.exe
2036	otqgyknv.exe
1336	rxynsqwcdguihmr.exe
1336	rxynsqwcdguihmr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1980	otqgyknv.exe
1980	otqgyknv.exe
1980	otqgyknv.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
364	WINWORD.EXE
364	WINWORD.EXE
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe

Suspicious use of SendNotifyMessage 41 IoCs

pid	Process
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
1788	ntxntvsnbu.exe
1788	ntxntvsnbu.exe
1788	ntxntvsnbu.exe
2036	otqgyknv.exe
2036	otqgyknv.exe
2036	otqgyknv.exe
1336	rxynsqwcdguihmr.exe
1336	rxynsqwcdguihmr.exe
1336	rxynsqwcdguihmr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
1096	cvapnccymjfjr.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe
816	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
364	WINWORD.EXE
364	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1788	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	27
PID 832 wrote to memory of 1788	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	27
PID 832 wrote to memory of 1788	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	27
PID 832 wrote to memory of 1788	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	27
PID 832 wrote to memory of 1336	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	28
PID 832 wrote to memory of 1336	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	28
PID 832 wrote to memory of 1336	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	28
PID 832 wrote to memory of 1336	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	28
PID 832 wrote to memory of 2036	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	29
PID 832 wrote to memory of 2036	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	29
PID 832 wrote to memory of 2036	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	29
PID 832 wrote to memory of 2036	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	29
PID 832 wrote to memory of 1096	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	30
PID 832 wrote to memory of 1096	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	30
PID 832 wrote to memory of 1096	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	30
PID 832 wrote to memory of 1096	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	30
PID 1788 wrote to memory of 1980	1788	ntxntvsnbu.exe	31
PID 1788 wrote to memory of 1980	1788	ntxntvsnbu.exe	31
PID 1788 wrote to memory of 1980	1788	ntxntvsnbu.exe	31
PID 1788 wrote to memory of 1980	1788	ntxntvsnbu.exe	31
PID 832 wrote to memory of 364	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	32
PID 832 wrote to memory of 364	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	32
PID 832 wrote to memory of 364	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	32
PID 832 wrote to memory of 364	832	a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe	32
PID 364 wrote to memory of 952	364	WINWORD.EXE	39
PID 364 wrote to memory of 952	364	WINWORD.EXE	39
PID 364 wrote to memory of 952	364	WINWORD.EXE	39
PID 364 wrote to memory of 952	364	WINWORD.EXE	39

C:\Users\Admin\AppData\Local\Temp\a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe
"C:\Users\Admin\AppData\Local\Temp\a08d985e5953ef9e9fd082b690b03b9baac8d9355004bfb021c7cbf01760b806.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\ntxntvsnbu.exe
  ntxntvsnbu.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\otqgyknv.exe
    C:\Windows\system32\otqgyknv.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:1980
- C:\Windows\SysWOW64\rxynsqwcdguihmr.exe
  rxynsqwcdguihmr.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1336
- C:\Windows\SysWOW64\otqgyknv.exe
  otqgyknv.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2036
- C:\Windows\SysWOW64\cvapnccymjfjr.exe
  cvapnccymjfjr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1096
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:952

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:816

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x578
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
1a95ae7ba8e90f9ec320a19ba64fdd98

SHA1
783fe9bc239cdc845a58d6bb9917fc571ac5ab2d

SHA256
43592c1e91aae077b2f588c04fabeccd5c4e9fb1c7bc5781a0071a4192c76138

SHA512
9ed51dd4b7770655ed5ce23b3932dbf24c6f60364b719d7448c39f7a024f521b2fa797df3839ae9f40539eff029100aa722c625eaa7dd16d767a7b79f75332ac

Download Submit
C:\Windows\SysWOW64\cvapnccymjfjr.exe

Filesize
255KB

MD5
c2e8ab3f45aa63ed4296478e1668bdf3

SHA1
ed823869c1d24e870500de6cc1ada36b13c56d88

SHA256
bfb282bf816b696a5ad8ed946549a4e506d786ff6d35a0bea97a8536e1028d5d

SHA512
889700d6017c901c5d95236aa0c21880b349dad0c83c0f9a776f991619b08e39a3d8847cce052742835c1ca8440168af7f85dccb453cf5dd23cb3de4f0990d46

Download Submit
C:\Windows\SysWOW64\cvapnccymjfjr.exe

Filesize
255KB

MD5
c2e8ab3f45aa63ed4296478e1668bdf3

SHA1
ed823869c1d24e870500de6cc1ada36b13c56d88

SHA256
bfb282bf816b696a5ad8ed946549a4e506d786ff6d35a0bea97a8536e1028d5d

SHA512
889700d6017c901c5d95236aa0c21880b349dad0c83c0f9a776f991619b08e39a3d8847cce052742835c1ca8440168af7f85dccb453cf5dd23cb3de4f0990d46

Download Submit
C:\Windows\SysWOW64\ntxntvsnbu.exe

Filesize
255KB

MD5
d8b6a207707feb041191248e0b3984a2

SHA1
13c28a617f9ae97e4eab726f6149c81a3cf9460e

SHA256
38061f9714a499c7eb23629b2eafd3dc3e286785e81bb4cf42327130d91f8f44

SHA512
ef9fccf98ca69368576248fcd5fc20f1f4c3756b07c755efc582c3f323433b32fb60b5898fbf9b171eb11da25ad1e19c65d8065acb786d7c62e1262a6817f932

Download Submit
C:\Windows\SysWOW64\ntxntvsnbu.exe

Filesize
255KB

MD5
d8b6a207707feb041191248e0b3984a2

SHA1
13c28a617f9ae97e4eab726f6149c81a3cf9460e

SHA256
38061f9714a499c7eb23629b2eafd3dc3e286785e81bb4cf42327130d91f8f44

SHA512
ef9fccf98ca69368576248fcd5fc20f1f4c3756b07c755efc582c3f323433b32fb60b5898fbf9b171eb11da25ad1e19c65d8065acb786d7c62e1262a6817f932

Download Submit
C:\Windows\SysWOW64\otqgyknv.exe

Filesize
255KB

MD5
8eaa66a13c940dc07fe00d403ebc858e

SHA1
bc9f488b7b31e04ce01a1a6b3e8c3d1558d719a9

SHA256
f408b3563425c660a3cd3f76ac4ca160741208b73ffc707d876f1bfa94ea09d5

SHA512
50f1ef629f646d6fb5c31f131d390172fccddff6fee7031b7c1c79a35f0a7e55f308e40f12b1278795aedae253a008b1c318ad9747f57d7724e77bbe6a8784d6

Download Submit
C:\Windows\SysWOW64\otqgyknv.exe

Filesize
255KB

MD5
8eaa66a13c940dc07fe00d403ebc858e

SHA1
bc9f488b7b31e04ce01a1a6b3e8c3d1558d719a9

SHA256
f408b3563425c660a3cd3f76ac4ca160741208b73ffc707d876f1bfa94ea09d5

SHA512
50f1ef629f646d6fb5c31f131d390172fccddff6fee7031b7c1c79a35f0a7e55f308e40f12b1278795aedae253a008b1c318ad9747f57d7724e77bbe6a8784d6

Download Submit
C:\Windows\SysWOW64\otqgyknv.exe

Filesize
255KB

MD5
8eaa66a13c940dc07fe00d403ebc858e

SHA1
bc9f488b7b31e04ce01a1a6b3e8c3d1558d719a9

SHA256
f408b3563425c660a3cd3f76ac4ca160741208b73ffc707d876f1bfa94ea09d5

SHA512
50f1ef629f646d6fb5c31f131d390172fccddff6fee7031b7c1c79a35f0a7e55f308e40f12b1278795aedae253a008b1c318ad9747f57d7724e77bbe6a8784d6

Download Submit
C:\Windows\SysWOW64\rxynsqwcdguihmr.exe

Filesize
255KB

MD5
707c857f716970925ff7f6ad27c1c5ce

SHA1
cf5184647fb9a7dc3501bb685a16a2663e201858

SHA256
583bd79f9062cd7c53b7fc12dd830632c05c6d6df7ce77687c05378ab1315144

SHA512
18872251726e6f56417d47ba9a0e829c0858e8cea0b8ecb0fde95fb42dbca0c56891299af22319e27f7a40937c019acd2021d526302bfc5da90db2b378c1355b

Download Submit
C:\Windows\SysWOW64\rxynsqwcdguihmr.exe

Filesize
255KB

MD5
707c857f716970925ff7f6ad27c1c5ce

SHA1
cf5184647fb9a7dc3501bb685a16a2663e201858

SHA256
583bd79f9062cd7c53b7fc12dd830632c05c6d6df7ce77687c05378ab1315144

SHA512
18872251726e6f56417d47ba9a0e829c0858e8cea0b8ecb0fde95fb42dbca0c56891299af22319e27f7a40937c019acd2021d526302bfc5da90db2b378c1355b

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
1a95ae7ba8e90f9ec320a19ba64fdd98

SHA1
783fe9bc239cdc845a58d6bb9917fc571ac5ab2d

SHA256
43592c1e91aae077b2f588c04fabeccd5c4e9fb1c7bc5781a0071a4192c76138

SHA512
9ed51dd4b7770655ed5ce23b3932dbf24c6f60364b719d7448c39f7a024f521b2fa797df3839ae9f40539eff029100aa722c625eaa7dd16d767a7b79f75332ac

Download Submit
\Windows\SysWOW64\cvapnccymjfjr.exe

Filesize
255KB

MD5
c2e8ab3f45aa63ed4296478e1668bdf3

SHA1
ed823869c1d24e870500de6cc1ada36b13c56d88

SHA256
bfb282bf816b696a5ad8ed946549a4e506d786ff6d35a0bea97a8536e1028d5d

SHA512
889700d6017c901c5d95236aa0c21880b349dad0c83c0f9a776f991619b08e39a3d8847cce052742835c1ca8440168af7f85dccb453cf5dd23cb3de4f0990d46

Download Submit
\Windows\SysWOW64\ntxntvsnbu.exe

Filesize
255KB

MD5
d8b6a207707feb041191248e0b3984a2

SHA1
13c28a617f9ae97e4eab726f6149c81a3cf9460e

SHA256
38061f9714a499c7eb23629b2eafd3dc3e286785e81bb4cf42327130d91f8f44

SHA512
ef9fccf98ca69368576248fcd5fc20f1f4c3756b07c755efc582c3f323433b32fb60b5898fbf9b171eb11da25ad1e19c65d8065acb786d7c62e1262a6817f932

Download Submit
\Windows\SysWOW64\otqgyknv.exe

Filesize
255KB

MD5
8eaa66a13c940dc07fe00d403ebc858e

SHA1
bc9f488b7b31e04ce01a1a6b3e8c3d1558d719a9

SHA256
f408b3563425c660a3cd3f76ac4ca160741208b73ffc707d876f1bfa94ea09d5

SHA512
50f1ef629f646d6fb5c31f131d390172fccddff6fee7031b7c1c79a35f0a7e55f308e40f12b1278795aedae253a008b1c318ad9747f57d7724e77bbe6a8784d6

Download Submit
\Windows\SysWOW64\otqgyknv.exe

Filesize
255KB

MD5
8eaa66a13c940dc07fe00d403ebc858e

SHA1
bc9f488b7b31e04ce01a1a6b3e8c3d1558d719a9

SHA256
f408b3563425c660a3cd3f76ac4ca160741208b73ffc707d876f1bfa94ea09d5

SHA512
50f1ef629f646d6fb5c31f131d390172fccddff6fee7031b7c1c79a35f0a7e55f308e40f12b1278795aedae253a008b1c318ad9747f57d7724e77bbe6a8784d6

Download Submit
\Windows\SysWOW64\rxynsqwcdguihmr.exe

Filesize
255KB

MD5
707c857f716970925ff7f6ad27c1c5ce

SHA1
cf5184647fb9a7dc3501bb685a16a2663e201858

SHA256
583bd79f9062cd7c53b7fc12dd830632c05c6d6df7ce77687c05378ab1315144

SHA512
18872251726e6f56417d47ba9a0e829c0858e8cea0b8ecb0fde95fb42dbca0c56891299af22319e27f7a40937c019acd2021d526302bfc5da90db2b378c1355b

Download Submit
memory/364-95-0x000000006B151000-0x000000006B153000-memory.dmp

Filesize
8KB

Download
memory/364-96-0x000000006AFE1000-0x000000006AFE3000-memory.dmp

Filesize
8KB

Download
memory/364-92-0x0000000070CAD000-0x0000000070CB8000-memory.dmp

Filesize
44KB

Download
memory/364-90-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/364-89-0x000000006FCC1000-0x000000006FCC3000-memory.dmp

Filesize
8KB

Download
memory/364-88-0x0000000072241000-0x0000000072244000-memory.dmp

Filesize
12KB

Download
memory/364-102-0x0000000070CAD000-0x0000000070CB8000-memory.dmp

Filesize
44KB

Download
memory/816-93-0x000007FEFB241000-0x000007FEFB243000-memory.dmp

Filesize
8KB

Download
memory/816-107-0x0000000002650000-0x0000000002660000-memory.dmp

Filesize
64KB

Download
memory/832-75-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/832-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/832-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/832-76-0x0000000002E70000-0x0000000002F10000-memory.dmp

Filesize
640KB

Download
memory/1096-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1096-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1336-78-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1336-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1788-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1788-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1980-101-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1980-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2036-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2036-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download