045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad

Analysis

max time kernel
188s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
Size

256KB
MD5

a19e86bcc2a7e337772b0a4b872cf600
SHA1

dddfce9b3b20046267f1513510867da139881b90
SHA256

045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad
SHA512

3d8b7d2f6dcb7699970b3ea1c72438b1dd2f35d0c7278544d9bcf177f3fa70b4f60e079a7678f77764fff09cf20fdd0983a2e915b9272ed67ea20b407799dcf2
SSDEEP

6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6k:Plf5j6zCNa0xeE3mR

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	pygtugnmoz.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	pygtugnmoz.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	pygtugnmoz.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pygtugnmoz.exe

Executes dropped EXE 5 IoCs

pid	Process
1740	pygtugnmoz.exe
1736	zladpmuaeywrqek.exe
2028	dghnrcle.exe
272	lvezbhqhtzonz.exe
1856	dghnrcle.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000054a8-55.dat	upx
behavioral1/files/0x000c0000000054a8-57.dat	upx
behavioral1/files/0x000a000000013473-60.dat	upx
behavioral1/files/0x000c0000000054a8-59.dat	upx
behavioral1/files/0x000a000000013473-63.dat	upx
behavioral1/memory/956-62-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x000a000000013473-70.dat	upx
behavioral1/files/0x00070000000139fe-69.dat	upx
behavioral1/files/0x00070000000139fe-74.dat	upx
behavioral1/files/0x00080000000139f2-72.dat	upx
behavioral1/memory/1740-68-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00080000000139f2-66.dat	upx
behavioral1/memory/2028-76-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00070000000139fe-78.dat	upx
behavioral1/files/0x00080000000139f2-79.dat	upx
behavioral1/memory/272-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00080000000139f2-80.dat	upx
behavioral1/files/0x00080000000139f2-82.dat	upx
behavioral1/memory/956-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1736-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1856-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1740-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2028-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/272-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1736-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1856-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x000600000001449e-102.dat	upx
behavioral1/files/0x000600000001453c-103.dat	upx
behavioral1/files/0x000600000001469d-105.dat	upx
behavioral1/files/0x000600000001469d-104.dat	upx
behavioral1/files/0x0006000000014737-106.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
1740	pygtugnmoz.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	pygtugnmoz.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "lvezbhqhtzonz.exe"	zladpmuaeywrqek.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	zladpmuaeywrqek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mzourzxu = "pygtugnmoz.exe"	zladpmuaeywrqek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wfalrfvj = "zladpmuaeywrqek.exe"	zladpmuaeywrqek.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	dghnrcle.exe
File opened (read-only)	\??\a:	pygtugnmoz.exe
File opened (read-only)	\??\i:	pygtugnmoz.exe
File opened (read-only)	\??\o:	dghnrcle.exe
File opened (read-only)	\??\u:	pygtugnmoz.exe
File opened (read-only)	\??\e:	dghnrcle.exe
File opened (read-only)	\??\x:	dghnrcle.exe
File opened (read-only)	\??\g:	dghnrcle.exe
File opened (read-only)	\??\k:	dghnrcle.exe
File opened (read-only)	\??\m:	dghnrcle.exe
File opened (read-only)	\??\g:	pygtugnmoz.exe
File opened (read-only)	\??\l:	pygtugnmoz.exe
File opened (read-only)	\??\u:	dghnrcle.exe
File opened (read-only)	\??\y:	dghnrcle.exe
File opened (read-only)	\??\p:	dghnrcle.exe
File opened (read-only)	\??\k:	pygtugnmoz.exe
File opened (read-only)	\??\v:	pygtugnmoz.exe
File opened (read-only)	\??\w:	pygtugnmoz.exe
File opened (read-only)	\??\q:	dghnrcle.exe
File opened (read-only)	\??\q:	dghnrcle.exe
File opened (read-only)	\??\f:	pygtugnmoz.exe
File opened (read-only)	\??\r:	pygtugnmoz.exe
File opened (read-only)	\??\t:	pygtugnmoz.exe
File opened (read-only)	\??\i:	dghnrcle.exe
File opened (read-only)	\??\n:	pygtugnmoz.exe
File opened (read-only)	\??\o:	pygtugnmoz.exe
File opened (read-only)	\??\m:	dghnrcle.exe
File opened (read-only)	\??\k:	dghnrcle.exe
File opened (read-only)	\??\t:	dghnrcle.exe
File opened (read-only)	\??\z:	dghnrcle.exe
File opened (read-only)	\??\l:	dghnrcle.exe
File opened (read-only)	\??\s:	dghnrcle.exe
File opened (read-only)	\??\q:	pygtugnmoz.exe
File opened (read-only)	\??\x:	pygtugnmoz.exe
File opened (read-only)	\??\z:	pygtugnmoz.exe
File opened (read-only)	\??\a:	dghnrcle.exe
File opened (read-only)	\??\h:	dghnrcle.exe
File opened (read-only)	\??\e:	pygtugnmoz.exe
File opened (read-only)	\??\m:	pygtugnmoz.exe
File opened (read-only)	\??\s:	dghnrcle.exe
File opened (read-only)	\??\p:	dghnrcle.exe
File opened (read-only)	\??\i:	dghnrcle.exe
File opened (read-only)	\??\t:	dghnrcle.exe
File opened (read-only)	\??\j:	pygtugnmoz.exe
File opened (read-only)	\??\j:	dghnrcle.exe
File opened (read-only)	\??\n:	dghnrcle.exe
File opened (read-only)	\??\l:	dghnrcle.exe
File opened (read-only)	\??\r:	dghnrcle.exe
File opened (read-only)	\??\e:	dghnrcle.exe
File opened (read-only)	\??\f:	dghnrcle.exe
File opened (read-only)	\??\o:	dghnrcle.exe
File opened (read-only)	\??\b:	pygtugnmoz.exe
File opened (read-only)	\??\h:	pygtugnmoz.exe
File opened (read-only)	\??\p:	pygtugnmoz.exe
File opened (read-only)	\??\s:	pygtugnmoz.exe
File opened (read-only)	\??\a:	dghnrcle.exe
File opened (read-only)	\??\v:	dghnrcle.exe
File opened (read-only)	\??\w:	dghnrcle.exe
File opened (read-only)	\??\y:	pygtugnmoz.exe
File opened (read-only)	\??\h:	dghnrcle.exe
File opened (read-only)	\??\n:	dghnrcle.exe
File opened (read-only)	\??\u:	dghnrcle.exe
File opened (read-only)	\??\y:	dghnrcle.exe
File opened (read-only)	\??\z:	dghnrcle.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	pygtugnmoz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	pygtugnmoz.exe

AutoIT Executable 11 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/956-62-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1740-68-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/272-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/956-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1736-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1856-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1740-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2028-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/272-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1736-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1856-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zladpmuaeywrqek.exe	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
File opened for modification	C:\Windows\SysWOW64\zladpmuaeywrqek.exe	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
File created	C:\Windows\SysWOW64\dghnrcle.exe	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
File opened for modification	C:\Windows\SysWOW64\dghnrcle.exe	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	pygtugnmoz.exe
File created	C:\Windows\SysWOW64\pygtugnmoz.exe	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
File opened for modification	C:\Windows\SysWOW64\pygtugnmoz.exe	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
File created	C:\Windows\SysWOW64\lvezbhqhtzonz.exe	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
File opened for modification	C:\Windows\SysWOW64\lvezbhqhtzonz.exe	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	dghnrcle.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	dghnrcle.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	dghnrcle.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	dghnrcle.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	dghnrcle.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	dghnrcle.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	dghnrcle.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	dghnrcle.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	dghnrcle.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	dghnrcle.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	dghnrcle.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	dghnrcle.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	dghnrcle.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	dghnrcle.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	dghnrcle.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	pygtugnmoz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	pygtugnmoz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB0B12D47E639EC52CCBAD13299D7B8"	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	pygtugnmoz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFDFCF8485C821B9141D72F7E94BDE5E636583667316330D69E"	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32432D089C5582206D4276D770512CAC7D8165AA"	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
908	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
1740	pygtugnmoz.exe
1740	pygtugnmoz.exe
1740	pygtugnmoz.exe
1740	pygtugnmoz.exe
1740	pygtugnmoz.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
2028	dghnrcle.exe
2028	dghnrcle.exe
2028	dghnrcle.exe
2028	dghnrcle.exe
1856	dghnrcle.exe
1856	dghnrcle.exe
1856	dghnrcle.exe
1856	dghnrcle.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
272	lvezbhqhtzonz.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
1740	pygtugnmoz.exe
1740	pygtugnmoz.exe
1740	pygtugnmoz.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
2028	dghnrcle.exe
272	lvezbhqhtzonz.exe
2028	dghnrcle.exe
272	lvezbhqhtzonz.exe
2028	dghnrcle.exe
1856	dghnrcle.exe
1856	dghnrcle.exe
1856	dghnrcle.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
1740	pygtugnmoz.exe
1740	pygtugnmoz.exe
1740	pygtugnmoz.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
1736	zladpmuaeywrqek.exe
272	lvezbhqhtzonz.exe
2028	dghnrcle.exe
272	lvezbhqhtzonz.exe
2028	dghnrcle.exe
272	lvezbhqhtzonz.exe
2028	dghnrcle.exe
1856	dghnrcle.exe
1856	dghnrcle.exe
1856	dghnrcle.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
908	WINWORD.EXE
908	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1740	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	27
PID 956 wrote to memory of 1740	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	27
PID 956 wrote to memory of 1740	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	27
PID 956 wrote to memory of 1740	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	27
PID 956 wrote to memory of 1736	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	28
PID 956 wrote to memory of 1736	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	28
PID 956 wrote to memory of 1736	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	28
PID 956 wrote to memory of 1736	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	28
PID 956 wrote to memory of 2028	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	29
PID 956 wrote to memory of 2028	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	29
PID 956 wrote to memory of 2028	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	29
PID 956 wrote to memory of 2028	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	29
PID 956 wrote to memory of 272	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	30
PID 956 wrote to memory of 272	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	30
PID 956 wrote to memory of 272	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	30
PID 956 wrote to memory of 272	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	30
PID 1740 wrote to memory of 1856	1740	pygtugnmoz.exe	31
PID 1740 wrote to memory of 1856	1740	pygtugnmoz.exe	31
PID 1740 wrote to memory of 1856	1740	pygtugnmoz.exe	31
PID 1740 wrote to memory of 1856	1740	pygtugnmoz.exe	31
PID 956 wrote to memory of 908	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	32
PID 956 wrote to memory of 908	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	32
PID 956 wrote to memory of 908	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	32
PID 956 wrote to memory of 908	956	045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe	32
PID 908 wrote to memory of 1648	908	WINWORD.EXE	36
PID 908 wrote to memory of 1648	908	WINWORD.EXE	36
PID 908 wrote to memory of 1648	908	WINWORD.EXE	36
PID 908 wrote to memory of 1648	908	WINWORD.EXE	36

C:\Users\Admin\AppData\Local\Temp\045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
"C:\Users\Admin\AppData\Local\Temp\045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\pygtugnmoz.exe
  pygtugnmoz.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\dghnrcle.exe
    C:\Windows\system32\dghnrcle.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1856
- C:\Windows\SysWOW64\zladpmuaeywrqek.exe
  zladpmuaeywrqek.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1736
- C:\Windows\SysWOW64\dghnrcle.exe
  dghnrcle.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2028
- C:\Windows\SysWOW64\lvezbhqhtzonz.exe
  lvezbhqhtzonz.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:272
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
256KB

MD5
351feb8b78de6b7c3370a4436bf4912c

SHA1
04f4e64c2e1d8a5c3d6e430bd4e335809764b9db

SHA256
583b74ddbb14fa42ae2fe1dcb5bed00a421f1e51a011a4d2412ce8558748cf7c

SHA512
2cb65a39f0b1e87a8ca61a3d26f855c0c9c5902fbcf8b8e09e6337a246ce3cf36724522e8ad27a576627b703f97f940089b0fdfdc969e3b24f086046d00e0e3f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
256KB

MD5
d120a1e1af2de8d311214aa52e84d67e

SHA1
4a891e3de1d6a5a62633f54d3df95b3adc4d60d5

SHA256
4b8273911e43e0e7a60011d842d528b8841806bf4deb4d064b15d30488dff273

SHA512
14f9fedfed5f3812ef123b745ad4efd13b656734076d062bf51b7cfa17d486de813c8a2d3ea0d587d7458231cabaa8dac1c7a5f3b6767924df02ef1d45eef1a5

Download Submit
C:\Users\Admin\AppData\Roaming\SavePublish.doc.exe

Filesize
256KB

MD5
bebae606dbfaa4258cf26b01f8d7a8c8

SHA1
bc686174fc96b50b853125ed038ff8220c360c28

SHA256
066de6fe813453bd983c89cf0a3cc7ce66c5c2c9e13a5c35c510a129b6cb3c15

SHA512
ef6eae3f02160fc7bb9c59f4b1097bd0a2458cf7430acd8e92c64df745165efe7fd2f6e501b557a9afd8582e4da1e4ff68d6acfb4ecbac7d359d9689aea88570

Download Submit
C:\Users\Admin\AppData\Roaming\SavePublish.doc.exe

Filesize
256KB

MD5
bebae606dbfaa4258cf26b01f8d7a8c8

SHA1
bc686174fc96b50b853125ed038ff8220c360c28

SHA256
066de6fe813453bd983c89cf0a3cc7ce66c5c2c9e13a5c35c510a129b6cb3c15

SHA512
ef6eae3f02160fc7bb9c59f4b1097bd0a2458cf7430acd8e92c64df745165efe7fd2f6e501b557a9afd8582e4da1e4ff68d6acfb4ecbac7d359d9689aea88570

Download Submit
C:\Users\Admin\Downloads\UnlockBackup.doc.exe

Filesize
256KB

MD5
be5021300c41f4bc8125aa69176438dd

SHA1
f3cca84c74623553d8c4bdf9190287fae38a119f

SHA256
d3a0557fef92af72a859392c9baef876b369e8b6d7341eaf428a3eccd41d82f5

SHA512
26733556490ac1ecc38dd32dd79a2c9312e558aff041d942f15ff1fbcd2a3e052f272e68adb8e60e76006b0260eab49218e78c0ac41abeaf1aad8e3798c01fda

Download Submit
C:\Windows\SysWOW64\dghnrcle.exe

Filesize
256KB

MD5
cd85ef3045b5275e7e325c1e8e60e393

SHA1
2ed8c9e7abac017ebb6429580c0ed82721ea76ef

SHA256
aa7b35e447294ab28263a48aa2e246789caeaa3f9a3d947a40a4be072edf786b

SHA512
31c9fdc19dc601dfbc60fd468e0a49e38bdbcb2b33828c02f231b40cae98399df01fe66a3cfe79425523701d7a02462d128da9c6f0ab45147a362675a7cf8da2

Download Submit
C:\Windows\SysWOW64\dghnrcle.exe

Filesize
256KB

MD5
cd85ef3045b5275e7e325c1e8e60e393

SHA1
2ed8c9e7abac017ebb6429580c0ed82721ea76ef

SHA256
aa7b35e447294ab28263a48aa2e246789caeaa3f9a3d947a40a4be072edf786b

SHA512
31c9fdc19dc601dfbc60fd468e0a49e38bdbcb2b33828c02f231b40cae98399df01fe66a3cfe79425523701d7a02462d128da9c6f0ab45147a362675a7cf8da2

Download Submit
C:\Windows\SysWOW64\dghnrcle.exe

Filesize
256KB

MD5
cd85ef3045b5275e7e325c1e8e60e393

SHA1
2ed8c9e7abac017ebb6429580c0ed82721ea76ef

SHA256
aa7b35e447294ab28263a48aa2e246789caeaa3f9a3d947a40a4be072edf786b

SHA512
31c9fdc19dc601dfbc60fd468e0a49e38bdbcb2b33828c02f231b40cae98399df01fe66a3cfe79425523701d7a02462d128da9c6f0ab45147a362675a7cf8da2

Download Submit
C:\Windows\SysWOW64\lvezbhqhtzonz.exe

Filesize
256KB

MD5
d5214e32f1a63915cb0079561951a391

SHA1
561cab2f2bd4c04590a396827429cbdafc29d909

SHA256
e857da5eb3c7b2cffbd0d38949ed7a669a5ecc2ebfdf27e89ab257fc499c95ad

SHA512
6ed15cee5207cd0a4034e5c9854644979e93e091215ba75fdb92908d1043ed771ce55ea2c62ddf18417fd395671b7dc902dda5b8d6c7a36cb1444f0160aaa535

Download Submit
C:\Windows\SysWOW64\lvezbhqhtzonz.exe

Filesize
256KB

MD5
d5214e32f1a63915cb0079561951a391

SHA1
561cab2f2bd4c04590a396827429cbdafc29d909

SHA256
e857da5eb3c7b2cffbd0d38949ed7a669a5ecc2ebfdf27e89ab257fc499c95ad

SHA512
6ed15cee5207cd0a4034e5c9854644979e93e091215ba75fdb92908d1043ed771ce55ea2c62ddf18417fd395671b7dc902dda5b8d6c7a36cb1444f0160aaa535

Download Submit
C:\Windows\SysWOW64\pygtugnmoz.exe

Filesize
256KB

MD5
d691420a0786c3fc8d0ff254f892050b

SHA1
0969c3f8a4c364072a2fc235860317ef5a500ff9

SHA256
95814b2b3f2f2e60a1901e9097cebf31bc95e2778f4c987dc0807685b1735c1b

SHA512
37749bc929598681bbccbe44b04ee82ae0f3d21fee5ba188835b476117d60160d32a8fc2611e19da96fc2cae23cae0642eb0e6430fcb5c2b9a36ce65cf1056d7

Download Submit
C:\Windows\SysWOW64\pygtugnmoz.exe

Filesize
256KB

MD5
d691420a0786c3fc8d0ff254f892050b

SHA1
0969c3f8a4c364072a2fc235860317ef5a500ff9

SHA256
95814b2b3f2f2e60a1901e9097cebf31bc95e2778f4c987dc0807685b1735c1b

SHA512
37749bc929598681bbccbe44b04ee82ae0f3d21fee5ba188835b476117d60160d32a8fc2611e19da96fc2cae23cae0642eb0e6430fcb5c2b9a36ce65cf1056d7

Download Submit
C:\Windows\SysWOW64\zladpmuaeywrqek.exe

Filesize
256KB

MD5
d2f61f48d0558e327862082c20db2e45

SHA1
eb47fa581e6dced1d174d3ba85248148ae22158d

SHA256
bc94ec978e6572a681b1fa080d17d2c2c731830eb4bd8b109180ee358e0580d4

SHA512
04ffcf56146ef6ef98eee5d8b8eca76bdfea3c7e13c212c6bf721ebd511842a3d069be229a20aca16afe23934f8b29cb72daab132129f99cd209776517539e66

Download Submit
C:\Windows\SysWOW64\zladpmuaeywrqek.exe

Filesize
256KB

MD5
d2f61f48d0558e327862082c20db2e45

SHA1
eb47fa581e6dced1d174d3ba85248148ae22158d

SHA256
bc94ec978e6572a681b1fa080d17d2c2c731830eb4bd8b109180ee358e0580d4

SHA512
04ffcf56146ef6ef98eee5d8b8eca76bdfea3c7e13c212c6bf721ebd511842a3d069be229a20aca16afe23934f8b29cb72daab132129f99cd209776517539e66

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\dghnrcle.exe

Filesize
256KB

MD5
cd85ef3045b5275e7e325c1e8e60e393

SHA1
2ed8c9e7abac017ebb6429580c0ed82721ea76ef

SHA256
aa7b35e447294ab28263a48aa2e246789caeaa3f9a3d947a40a4be072edf786b

SHA512
31c9fdc19dc601dfbc60fd468e0a49e38bdbcb2b33828c02f231b40cae98399df01fe66a3cfe79425523701d7a02462d128da9c6f0ab45147a362675a7cf8da2

Download Submit
\Windows\SysWOW64\dghnrcle.exe

Filesize
256KB

MD5
cd85ef3045b5275e7e325c1e8e60e393

SHA1
2ed8c9e7abac017ebb6429580c0ed82721ea76ef

SHA256
aa7b35e447294ab28263a48aa2e246789caeaa3f9a3d947a40a4be072edf786b

SHA512
31c9fdc19dc601dfbc60fd468e0a49e38bdbcb2b33828c02f231b40cae98399df01fe66a3cfe79425523701d7a02462d128da9c6f0ab45147a362675a7cf8da2

Download Submit
\Windows\SysWOW64\lvezbhqhtzonz.exe

Filesize
256KB

MD5
d5214e32f1a63915cb0079561951a391

SHA1
561cab2f2bd4c04590a396827429cbdafc29d909

SHA256
e857da5eb3c7b2cffbd0d38949ed7a669a5ecc2ebfdf27e89ab257fc499c95ad

SHA512
6ed15cee5207cd0a4034e5c9854644979e93e091215ba75fdb92908d1043ed771ce55ea2c62ddf18417fd395671b7dc902dda5b8d6c7a36cb1444f0160aaa535

Download Submit
\Windows\SysWOW64\pygtugnmoz.exe

Filesize
256KB

MD5
d691420a0786c3fc8d0ff254f892050b

SHA1
0969c3f8a4c364072a2fc235860317ef5a500ff9

SHA256
95814b2b3f2f2e60a1901e9097cebf31bc95e2778f4c987dc0807685b1735c1b

SHA512
37749bc929598681bbccbe44b04ee82ae0f3d21fee5ba188835b476117d60160d32a8fc2611e19da96fc2cae23cae0642eb0e6430fcb5c2b9a36ce65cf1056d7

Download Submit
\Windows\SysWOW64\zladpmuaeywrqek.exe

Filesize
256KB

MD5
d2f61f48d0558e327862082c20db2e45

SHA1
eb47fa581e6dced1d174d3ba85248148ae22158d

SHA256
bc94ec978e6572a681b1fa080d17d2c2c731830eb4bd8b109180ee358e0580d4

SHA512
04ffcf56146ef6ef98eee5d8b8eca76bdfea3c7e13c212c6bf721ebd511842a3d069be229a20aca16afe23934f8b29cb72daab132129f99cd209776517539e66

Download Submit
memory/272-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/272-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/908-108-0x00000000714DD000-0x00000000714E8000-memory.dmp

Filesize
44KB

Download
memory/908-107-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/908-93-0x00000000714DD000-0x00000000714E8000-memory.dmp

Filesize
44KB

Download
memory/908-86-0x0000000072A71000-0x0000000072A74000-memory.dmp

Filesize
12KB

Download
memory/908-90-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/908-88-0x00000000704F1000-0x00000000704F3000-memory.dmp

Filesize
8KB

Download
memory/908-99-0x00000000714DD000-0x00000000714E8000-memory.dmp

Filesize
44KB

Download
memory/956-54-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/956-62-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/956-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/956-65-0x0000000002480000-0x0000000002520000-memory.dmp

Filesize
640KB

Download
memory/1648-101-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

Filesize
8KB

Download
memory/1736-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1736-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1740-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1740-68-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1856-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1856-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2028-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2028-76-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download