2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c

Analysis

max time kernel
154s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-10-2022 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
Size

255KB
MD5

a164cf8fc65a53993af84a00e8fac670
SHA1

3da37fc78d0a60eda74089579a91af4db2178a9f
SHA256

2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c
SHA512

77db764b76984ac80c80c336aab8dbde4d03e756dc70a761b06b4321f7fd9bbe1b4372706fff5a3f0de9065090e5eb83876ee016964c84ca5f7d681722e7c3ba
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJY:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI5

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	wjfyankwke.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wjfyankwke.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wjfyankwke.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wjfyankwke.exe

Executes dropped EXE 5 IoCs

pid	Process
624	wjfyankwke.exe
1532	vjsbpdrs.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1940	vjsbpdrs.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2012-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-56.dat	upx
behavioral1/memory/2012-57-0x0000000002F40000-0x0000000002FE0000-memory.dmp	upx
behavioral1/files/0x000a0000000122e0-60.dat	upx
behavioral1/files/0x0007000000005c50-59.dat	upx
behavioral1/files/0x00090000000122f1-63.dat	upx
behavioral1/files/0x00090000000122f1-66.dat	upx
behavioral1/files/0x00090000000122f9-65.dat	upx
behavioral1/files/0x00090000000122f9-71.dat	upx
behavioral1/files/0x000a0000000122e0-69.dat	upx
behavioral1/files/0x000a0000000122e0-75.dat	upx
behavioral1/files/0x0007000000005c50-74.dat	upx
behavioral1/files/0x00090000000122f1-73.dat	upx
behavioral1/files/0x00090000000122f9-76.dat	upx
behavioral1/memory/624-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1532-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1612-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1748-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00090000000122f1-82.dat	upx
behavioral1/files/0x00090000000122f1-84.dat	upx
behavioral1/memory/1940-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2012-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/624-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1532-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1748-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1612-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1940-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00070000000135a6-103.dat	upx
behavioral1/files/0x0007000000013922-104.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
624	wjfyankwke.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wjfyankwke.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	bhvacyjgcrjmpwv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\derpgwfq = "wjfyankwke.exe"	bhvacyjgcrjmpwv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\khmpbbuz = "bhvacyjgcrjmpwv.exe"	bhvacyjgcrjmpwv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ymahhdiwquezy.exe"	bhvacyjgcrjmpwv.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	wjfyankwke.exe
File opened (read-only)	\??\a:	vjsbpdrs.exe
File opened (read-only)	\??\t:	vjsbpdrs.exe
File opened (read-only)	\??\x:	vjsbpdrs.exe
File opened (read-only)	\??\u:	vjsbpdrs.exe
File opened (read-only)	\??\f:	wjfyankwke.exe
File opened (read-only)	\??\g:	wjfyankwke.exe
File opened (read-only)	\??\v:	wjfyankwke.exe
File opened (read-only)	\??\y:	wjfyankwke.exe
File opened (read-only)	\??\j:	vjsbpdrs.exe
File opened (read-only)	\??\e:	vjsbpdrs.exe
File opened (read-only)	\??\o:	vjsbpdrs.exe
File opened (read-only)	\??\v:	vjsbpdrs.exe
File opened (read-only)	\??\y:	vjsbpdrs.exe
File opened (read-only)	\??\w:	vjsbpdrs.exe
File opened (read-only)	\??\a:	wjfyankwke.exe
File opened (read-only)	\??\l:	wjfyankwke.exe
File opened (read-only)	\??\m:	wjfyankwke.exe
File opened (read-only)	\??\q:	wjfyankwke.exe
File opened (read-only)	\??\b:	wjfyankwke.exe
File opened (read-only)	\??\k:	vjsbpdrs.exe
File opened (read-only)	\??\l:	vjsbpdrs.exe
File opened (read-only)	\??\q:	vjsbpdrs.exe
File opened (read-only)	\??\w:	vjsbpdrs.exe
File opened (read-only)	\??\i:	vjsbpdrs.exe
File opened (read-only)	\??\n:	vjsbpdrs.exe
File opened (read-only)	\??\h:	wjfyankwke.exe
File opened (read-only)	\??\p:	wjfyankwke.exe
File opened (read-only)	\??\m:	vjsbpdrs.exe
File opened (read-only)	\??\s:	vjsbpdrs.exe
File opened (read-only)	\??\z:	wjfyankwke.exe
File opened (read-only)	\??\p:	vjsbpdrs.exe
File opened (read-only)	\??\u:	vjsbpdrs.exe
File opened (read-only)	\??\i:	vjsbpdrs.exe
File opened (read-only)	\??\j:	vjsbpdrs.exe
File opened (read-only)	\??\g:	vjsbpdrs.exe
File opened (read-only)	\??\k:	vjsbpdrs.exe
File opened (read-only)	\??\r:	vjsbpdrs.exe
File opened (read-only)	\??\e:	wjfyankwke.exe
File opened (read-only)	\??\n:	wjfyankwke.exe
File opened (read-only)	\??\e:	vjsbpdrs.exe
File opened (read-only)	\??\h:	vjsbpdrs.exe
File opened (read-only)	\??\w:	wjfyankwke.exe
File opened (read-only)	\??\g:	vjsbpdrs.exe
File opened (read-only)	\??\b:	vjsbpdrs.exe
File opened (read-only)	\??\n:	vjsbpdrs.exe
File opened (read-only)	\??\z:	vjsbpdrs.exe
File opened (read-only)	\??\s:	vjsbpdrs.exe
File opened (read-only)	\??\p:	vjsbpdrs.exe
File opened (read-only)	\??\y:	vjsbpdrs.exe
File opened (read-only)	\??\i:	wjfyankwke.exe
File opened (read-only)	\??\o:	wjfyankwke.exe
File opened (read-only)	\??\f:	vjsbpdrs.exe
File opened (read-only)	\??\u:	wjfyankwke.exe
File opened (read-only)	\??\x:	wjfyankwke.exe
File opened (read-only)	\??\r:	wjfyankwke.exe
File opened (read-only)	\??\m:	vjsbpdrs.exe
File opened (read-only)	\??\o:	vjsbpdrs.exe
File opened (read-only)	\??\q:	vjsbpdrs.exe
File opened (read-only)	\??\z:	vjsbpdrs.exe
File opened (read-only)	\??\h:	vjsbpdrs.exe
File opened (read-only)	\??\a:	vjsbpdrs.exe
File opened (read-only)	\??\f:	vjsbpdrs.exe
File opened (read-only)	\??\k:	wjfyankwke.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	wjfyankwke.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	wjfyankwke.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2012-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/624-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1532-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1612-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1748-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1940-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2012-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/624-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1532-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1748-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1612-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1940-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bhvacyjgcrjmpwv.exe	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
File opened for modification	C:\Windows\SysWOW64\vjsbpdrs.exe	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
File created	C:\Windows\SysWOW64\ymahhdiwquezy.exe	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	wjfyankwke.exe
File opened for modification	C:\Windows\SysWOW64\ymahhdiwquezy.exe	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
File created	C:\Windows\SysWOW64\wjfyankwke.exe	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
File opened for modification	C:\Windows\SysWOW64\wjfyankwke.exe	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
File created	C:\Windows\SysWOW64\bhvacyjgcrjmpwv.exe	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
File created	C:\Windows\SysWOW64\vjsbpdrs.exe	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	vjsbpdrs.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vjsbpdrs.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vjsbpdrs.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vjsbpdrs.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	vjsbpdrs.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vjsbpdrs.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vjsbpdrs.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	vjsbpdrs.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vjsbpdrs.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vjsbpdrs.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vjsbpdrs.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	vjsbpdrs.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vjsbpdrs.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vjsbpdrs.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vjsbpdrs.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32442C0D9C5682566A4676A570562DD97D8564DC"	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BB0FF6622D8D20ED1A98A7F906B"	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	wjfyankwke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B1204494399952CEBAD633E8D4C5"	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	wjfyankwke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACEFABCFE6BF19883083A3186EA3996B08C038F4362034FE2CE45E709D3"	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	wjfyankwke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	wjfyankwke.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	wjfyankwke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	wjfyankwke.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1860	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
624	wjfyankwke.exe
624	wjfyankwke.exe
624	wjfyankwke.exe
624	wjfyankwke.exe
624	wjfyankwke.exe
1532	vjsbpdrs.exe
1532	vjsbpdrs.exe
1532	vjsbpdrs.exe
1532	vjsbpdrs.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1940	vjsbpdrs.exe
1940	vjsbpdrs.exe
1940	vjsbpdrs.exe
1940	vjsbpdrs.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
624	wjfyankwke.exe
1532	vjsbpdrs.exe
624	wjfyankwke.exe
1532	vjsbpdrs.exe
624	wjfyankwke.exe
1532	vjsbpdrs.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1940	vjsbpdrs.exe
1940	vjsbpdrs.exe
1940	vjsbpdrs.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
624	wjfyankwke.exe
1532	vjsbpdrs.exe
624	wjfyankwke.exe
1532	vjsbpdrs.exe
624	wjfyankwke.exe
1532	vjsbpdrs.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1612	ymahhdiwquezy.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1748	bhvacyjgcrjmpwv.exe
1940	vjsbpdrs.exe
1940	vjsbpdrs.exe
1940	vjsbpdrs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1860	WINWORD.EXE
1860	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 624	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	27
PID 2012 wrote to memory of 624	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	27
PID 2012 wrote to memory of 624	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	27
PID 2012 wrote to memory of 624	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	27
PID 2012 wrote to memory of 1748	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	28
PID 2012 wrote to memory of 1748	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	28
PID 2012 wrote to memory of 1748	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	28
PID 2012 wrote to memory of 1748	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	28
PID 2012 wrote to memory of 1532	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	29
PID 2012 wrote to memory of 1532	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	29
PID 2012 wrote to memory of 1532	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	29
PID 2012 wrote to memory of 1532	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	29
PID 2012 wrote to memory of 1612	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	30
PID 2012 wrote to memory of 1612	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	30
PID 2012 wrote to memory of 1612	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	30
PID 2012 wrote to memory of 1612	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	30
PID 624 wrote to memory of 1940	624	wjfyankwke.exe	31
PID 624 wrote to memory of 1940	624	wjfyankwke.exe	31
PID 624 wrote to memory of 1940	624	wjfyankwke.exe	31
PID 624 wrote to memory of 1940	624	wjfyankwke.exe	31
PID 2012 wrote to memory of 1860	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	32
PID 2012 wrote to memory of 1860	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	32
PID 2012 wrote to memory of 1860	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	32
PID 2012 wrote to memory of 1860	2012	2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe	32
PID 1860 wrote to memory of 308	1860	WINWORD.EXE	36
PID 1860 wrote to memory of 308	1860	WINWORD.EXE	36
PID 1860 wrote to memory of 308	1860	WINWORD.EXE	36
PID 1860 wrote to memory of 308	1860	WINWORD.EXE	36

C:\Users\Admin\AppData\Local\Temp\2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe
"C:\Users\Admin\AppData\Local\Temp\2f5c99155016ad6314856e3576ec709a0f3ea8402f5a80582f72dfca3e4f9d3c.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\wjfyankwke.exe
  wjfyankwke.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\SysWOW64\vjsbpdrs.exe
    C:\Windows\system32\vjsbpdrs.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1940
- C:\Windows\SysWOW64\bhvacyjgcrjmpwv.exe
  bhvacyjgcrjmpwv.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1748
- C:\Windows\SysWOW64\vjsbpdrs.exe
  vjsbpdrs.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1532
- C:\Windows\SysWOW64\ymahhdiwquezy.exe
  ymahhdiwquezy.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1612
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
62e37f7f871cb13f94f2811784aa8878

SHA1
29bc8360e1783729400a88911e92a027c5b3cbdc

SHA256
4bb355e79f3ca8fb947e5b1c39ea086f6eb853ce9ab3eff7a75e95f63deb736c

SHA512
02649b9c655ee7ea2b25f212812178b50e91e0db110ac29d94cee694be7c128c2626830454afa7c60d46c189e72b68f2bffe213c52c6c81269cd4cd8a7b86fb0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
be893d44ce79ba5cb1f74b9b4e96b665

SHA1
d579696dc868eaf28a7c94c8bf250beb177ca1b6

SHA256
3e9c30f7ed7d71aa5c0122dd526175d75fc9eb1977280913318ef55999b397b0

SHA512
aa42174dbfde7efceb9b486ca93dbcc4d75a8f41be1b1a485b57b694dc619feacb7b4d5831ae34d611b1ad25ce229f82054b59f030d8fdd27129afd6a6fd234a

Download Submit
C:\Windows\SysWOW64\bhvacyjgcrjmpwv.exe

Filesize
255KB

MD5
f79a94019c73815cd6107b73c19fa23d

SHA1
f96b15a48a2bb6279a13e8bec137abbb78b6386e

SHA256
daece16ab1dfb173ec58e7606ef6bfaef322d7e5b6368b8bdae8b5ba5185998d

SHA512
43dca3670190d9f3afe6af8b59a781c8bc51b60663c20be9516393cf9e6a3642fc2b6396f9be9871d3122437a1b959fd9d62590da7b2b90f0d823b47745609b9

Download Submit
C:\Windows\SysWOW64\bhvacyjgcrjmpwv.exe

Filesize
255KB

MD5
f79a94019c73815cd6107b73c19fa23d

SHA1
f96b15a48a2bb6279a13e8bec137abbb78b6386e

SHA256
daece16ab1dfb173ec58e7606ef6bfaef322d7e5b6368b8bdae8b5ba5185998d

SHA512
43dca3670190d9f3afe6af8b59a781c8bc51b60663c20be9516393cf9e6a3642fc2b6396f9be9871d3122437a1b959fd9d62590da7b2b90f0d823b47745609b9

Download Submit
C:\Windows\SysWOW64\vjsbpdrs.exe

Filesize
255KB

MD5
264558860a2641b6434b0b31837b431e

SHA1
899bd6f08f85802dc366323e07ba7df3bd8c5181

SHA256
11ace8b2144a20c9da5cd72c5c9d76499672cb24041d3cb66f1d649650dae6af

SHA512
9f4edda9bcb6e8932246449a3760b7d7634efdb54634085a9f6b9b107abde93c410a28eb2b19b394bfccc47d828e59a74a1c741e0b3330e059226a8c98689327

Download Submit
C:\Windows\SysWOW64\vjsbpdrs.exe

Filesize
255KB

MD5
264558860a2641b6434b0b31837b431e

SHA1
899bd6f08f85802dc366323e07ba7df3bd8c5181

SHA256
11ace8b2144a20c9da5cd72c5c9d76499672cb24041d3cb66f1d649650dae6af

SHA512
9f4edda9bcb6e8932246449a3760b7d7634efdb54634085a9f6b9b107abde93c410a28eb2b19b394bfccc47d828e59a74a1c741e0b3330e059226a8c98689327

Download Submit
C:\Windows\SysWOW64\vjsbpdrs.exe

Filesize
255KB

MD5
264558860a2641b6434b0b31837b431e

SHA1
899bd6f08f85802dc366323e07ba7df3bd8c5181

SHA256
11ace8b2144a20c9da5cd72c5c9d76499672cb24041d3cb66f1d649650dae6af

SHA512
9f4edda9bcb6e8932246449a3760b7d7634efdb54634085a9f6b9b107abde93c410a28eb2b19b394bfccc47d828e59a74a1c741e0b3330e059226a8c98689327

Download Submit
C:\Windows\SysWOW64\wjfyankwke.exe

Filesize
255KB

MD5
55cf24ee7a945f5dd63e2b0ca89a4414

SHA1
1a426a2ca0149c91c7f455bf18b48c107d851345

SHA256
c0c538438ccba7db6598502e039a111bd9bcaf3d01181a539a06ad01b2553581

SHA512
f4ac4bf7718914c1bf16841e4ea35a6a7632239e20ab29a679b10fc786fb4b8ed272de208b8b9f6a1d0260713af2fc47e4116da6102e7b15994331b11c07e8f0

Download Submit
C:\Windows\SysWOW64\wjfyankwke.exe

Filesize
255KB

MD5
55cf24ee7a945f5dd63e2b0ca89a4414

SHA1
1a426a2ca0149c91c7f455bf18b48c107d851345

SHA256
c0c538438ccba7db6598502e039a111bd9bcaf3d01181a539a06ad01b2553581

SHA512
f4ac4bf7718914c1bf16841e4ea35a6a7632239e20ab29a679b10fc786fb4b8ed272de208b8b9f6a1d0260713af2fc47e4116da6102e7b15994331b11c07e8f0

Download Submit
C:\Windows\SysWOW64\ymahhdiwquezy.exe

Filesize
255KB

MD5
6bb6d03057ddf3bc984c2affd127b03a

SHA1
66d2bb5c50d93ea160e2438b8ae29bf9bd3db432

SHA256
95dca675e14602e313e84d9f33f10d1a78dd89f712c9eb749a7708de45ca1b80

SHA512
f961989f04b9939f35f520fe48cf7d1a2a304c74683c0fbb23955b01e73e3fe12a43d91c2f9be7d85e093d4b8886d9e1e1be36455ef3b9b96812ac3a05ff498a

Download Submit
C:\Windows\SysWOW64\ymahhdiwquezy.exe

Filesize
255KB

MD5
6bb6d03057ddf3bc984c2affd127b03a

SHA1
66d2bb5c50d93ea160e2438b8ae29bf9bd3db432

SHA256
95dca675e14602e313e84d9f33f10d1a78dd89f712c9eb749a7708de45ca1b80

SHA512
f961989f04b9939f35f520fe48cf7d1a2a304c74683c0fbb23955b01e73e3fe12a43d91c2f9be7d85e093d4b8886d9e1e1be36455ef3b9b96812ac3a05ff498a

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\bhvacyjgcrjmpwv.exe

Filesize
255KB

MD5
f79a94019c73815cd6107b73c19fa23d

SHA1
f96b15a48a2bb6279a13e8bec137abbb78b6386e

SHA256
daece16ab1dfb173ec58e7606ef6bfaef322d7e5b6368b8bdae8b5ba5185998d

SHA512
43dca3670190d9f3afe6af8b59a781c8bc51b60663c20be9516393cf9e6a3642fc2b6396f9be9871d3122437a1b959fd9d62590da7b2b90f0d823b47745609b9

Download Submit
\Windows\SysWOW64\vjsbpdrs.exe

Filesize
255KB

MD5
264558860a2641b6434b0b31837b431e

SHA1
899bd6f08f85802dc366323e07ba7df3bd8c5181

SHA256
11ace8b2144a20c9da5cd72c5c9d76499672cb24041d3cb66f1d649650dae6af

SHA512
9f4edda9bcb6e8932246449a3760b7d7634efdb54634085a9f6b9b107abde93c410a28eb2b19b394bfccc47d828e59a74a1c741e0b3330e059226a8c98689327

Download Submit
\Windows\SysWOW64\vjsbpdrs.exe

Filesize
255KB

MD5
264558860a2641b6434b0b31837b431e

SHA1
899bd6f08f85802dc366323e07ba7df3bd8c5181

SHA256
11ace8b2144a20c9da5cd72c5c9d76499672cb24041d3cb66f1d649650dae6af

SHA512
9f4edda9bcb6e8932246449a3760b7d7634efdb54634085a9f6b9b107abde93c410a28eb2b19b394bfccc47d828e59a74a1c741e0b3330e059226a8c98689327

Download Submit
\Windows\SysWOW64\wjfyankwke.exe

Filesize
255KB

MD5
55cf24ee7a945f5dd63e2b0ca89a4414

SHA1
1a426a2ca0149c91c7f455bf18b48c107d851345

SHA256
c0c538438ccba7db6598502e039a111bd9bcaf3d01181a539a06ad01b2553581

SHA512
f4ac4bf7718914c1bf16841e4ea35a6a7632239e20ab29a679b10fc786fb4b8ed272de208b8b9f6a1d0260713af2fc47e4116da6102e7b15994331b11c07e8f0

Download Submit
\Windows\SysWOW64\ymahhdiwquezy.exe

Filesize
255KB

MD5
6bb6d03057ddf3bc984c2affd127b03a

SHA1
66d2bb5c50d93ea160e2438b8ae29bf9bd3db432

SHA256
95dca675e14602e313e84d9f33f10d1a78dd89f712c9eb749a7708de45ca1b80

SHA512
f961989f04b9939f35f520fe48cf7d1a2a304c74683c0fbb23955b01e73e3fe12a43d91c2f9be7d85e093d4b8886d9e1e1be36455ef3b9b96812ac3a05ff498a

Download Submit
memory/308-102-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

Filesize
8KB

Download
memory/624-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/624-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1532-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1532-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1612-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1612-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1748-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1748-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1860-97-0x0000000070D3D000-0x0000000070D48000-memory.dmp

Filesize
44KB

Download
memory/1860-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1860-100-0x0000000070D3D000-0x0000000070D48000-memory.dmp

Filesize
44KB

Download
memory/1860-90-0x000000006FD51000-0x000000006FD53000-memory.dmp

Filesize
8KB

Download
memory/1860-89-0x00000000722D1000-0x00000000722D4000-memory.dmp

Filesize
12KB

Download
memory/1940-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1940-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2012-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2012-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/2012-78-0x0000000002F40000-0x0000000002FE0000-memory.dmp

Filesize
640KB

Download
memory/2012-57-0x0000000002F40000-0x0000000002FE0000-memory.dmp

Filesize
640KB

Download
memory/2012-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download