972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2

Analysis

max time kernel
151s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
Size

255KB
MD5

0bb8bf255ed1dfa18518b09099b4c050
SHA1

bb8c0a006e2898cc0e9ed6f81aae0a9d3b0efb8f
SHA256

972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2
SHA512

79839390c7c26eeb16936b10453b78f617aaacc92f8a90eb1a14446c8aec92c7b5fa37cc5db4d180b76a5e70a26a93dde246217466142b8ddcf5e35e35c608cb
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJK:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIz

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	kjyjyqemhk.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kjyjyqemhk.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	kjyjyqemhk.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kjyjyqemhk.exe

Executes dropped EXE 5 IoCs

pid	Process
1724	kjyjyqemhk.exe
976	ytsoguaehjnvoet.exe
956	ynmdqylo.exe
1480	cippbawyiztyj.exe
836	ynmdqylo.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-55.dat	upx
behavioral1/memory/288-56-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/288-57-0x00000000033E0000-0x0000000003480000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-59.dat	upx
behavioral1/files/0x00140000000054ab-61.dat	upx
behavioral1/files/0x000900000001267a-62.dat	upx
behavioral1/files/0x000900000001267a-64.dat	upx
behavioral1/files/0x0008000000012726-66.dat	upx
behavioral1/files/0x0008000000012726-68.dat	upx
behavioral1/files/0x000900000001267a-70.dat	upx
behavioral1/files/0x0007000000012744-71.dat	upx
behavioral1/files/0x0007000000012744-73.dat	upx
behavioral1/files/0x0008000000012726-74.dat	upx
behavioral1/memory/956-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/976-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1724-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0007000000012744-76.dat	upx
behavioral1/memory/1480-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0008000000012726-82.dat	upx
behavioral1/files/0x0008000000012726-84.dat	upx
behavioral1/memory/288-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/836-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1724-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/976-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/956-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1480-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1724-99-0x0000000003880000-0x0000000003920000-memory.dmp	upx
behavioral1/memory/836-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x000600000001420e-104.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
1724	kjyjyqemhk.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	kjyjyqemhk.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ytsoguaehjnvoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\plswzvtv = "kjyjyqemhk.exe"	ytsoguaehjnvoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oruuqjht = "ytsoguaehjnvoet.exe"	ytsoguaehjnvoet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "cippbawyiztyj.exe"	ytsoguaehjnvoet.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	ynmdqylo.exe
File opened (read-only)	\??\x:	ynmdqylo.exe
File opened (read-only)	\??\r:	kjyjyqemhk.exe
File opened (read-only)	\??\q:	ynmdqylo.exe
File opened (read-only)	\??\e:	ynmdqylo.exe
File opened (read-only)	\??\v:	ynmdqylo.exe
File opened (read-only)	\??\k:	ynmdqylo.exe
File opened (read-only)	\??\p:	ynmdqylo.exe
File opened (read-only)	\??\o:	ynmdqylo.exe
File opened (read-only)	\??\k:	kjyjyqemhk.exe
File opened (read-only)	\??\f:	kjyjyqemhk.exe
File opened (read-only)	\??\u:	ynmdqylo.exe
File opened (read-only)	\??\m:	ynmdqylo.exe
File opened (read-only)	\??\w:	ynmdqylo.exe
File opened (read-only)	\??\u:	ynmdqylo.exe
File opened (read-only)	\??\k:	ynmdqylo.exe
File opened (read-only)	\??\g:	kjyjyqemhk.exe
File opened (read-only)	\??\r:	ynmdqylo.exe
File opened (read-only)	\??\a:	kjyjyqemhk.exe
File opened (read-only)	\??\t:	ynmdqylo.exe
File opened (read-only)	\??\x:	kjyjyqemhk.exe
File opened (read-only)	\??\j:	ynmdqylo.exe
File opened (read-only)	\??\v:	ynmdqylo.exe
File opened (read-only)	\??\g:	ynmdqylo.exe
File opened (read-only)	\??\o:	ynmdqylo.exe
File opened (read-only)	\??\i:	ynmdqylo.exe
File opened (read-only)	\??\b:	kjyjyqemhk.exe
File opened (read-only)	\??\j:	kjyjyqemhk.exe
File opened (read-only)	\??\o:	kjyjyqemhk.exe
File opened (read-only)	\??\b:	ynmdqylo.exe
File opened (read-only)	\??\h:	ynmdqylo.exe
File opened (read-only)	\??\z:	ynmdqylo.exe
File opened (read-only)	\??\x:	ynmdqylo.exe
File opened (read-only)	\??\l:	kjyjyqemhk.exe
File opened (read-only)	\??\i:	ynmdqylo.exe
File opened (read-only)	\??\l:	ynmdqylo.exe
File opened (read-only)	\??\r:	ynmdqylo.exe
File opened (read-only)	\??\t:	kjyjyqemhk.exe
File opened (read-only)	\??\z:	kjyjyqemhk.exe
File opened (read-only)	\??\f:	ynmdqylo.exe
File opened (read-only)	\??\h:	ynmdqylo.exe
File opened (read-only)	\??\f:	ynmdqylo.exe
File opened (read-only)	\??\y:	ynmdqylo.exe
File opened (read-only)	\??\n:	ynmdqylo.exe
File opened (read-only)	\??\m:	kjyjyqemhk.exe
File opened (read-only)	\??\s:	kjyjyqemhk.exe
File opened (read-only)	\??\u:	kjyjyqemhk.exe
File opened (read-only)	\??\i:	kjyjyqemhk.exe
File opened (read-only)	\??\j:	ynmdqylo.exe
File opened (read-only)	\??\p:	ynmdqylo.exe
File opened (read-only)	\??\y:	ynmdqylo.exe
File opened (read-only)	\??\e:	kjyjyqemhk.exe
File opened (read-only)	\??\n:	kjyjyqemhk.exe
File opened (read-only)	\??\w:	kjyjyqemhk.exe
File opened (read-only)	\??\y:	kjyjyqemhk.exe
File opened (read-only)	\??\a:	ynmdqylo.exe
File opened (read-only)	\??\g:	ynmdqylo.exe
File opened (read-only)	\??\l:	ynmdqylo.exe
File opened (read-only)	\??\t:	ynmdqylo.exe
File opened (read-only)	\??\e:	ynmdqylo.exe
File opened (read-only)	\??\q:	ynmdqylo.exe
File opened (read-only)	\??\h:	kjyjyqemhk.exe
File opened (read-only)	\??\q:	kjyjyqemhk.exe
File opened (read-only)	\??\a:	ynmdqylo.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	kjyjyqemhk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	kjyjyqemhk.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/288-56-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/956-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/976-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1724-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1480-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/288-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/836-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1724-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/976-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/956-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1480-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1724-99-0x0000000003880000-0x0000000003920000-memory.dmp	autoit_exe
behavioral1/memory/836-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kjyjyqemhk.exe	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
File opened for modification	C:\Windows\SysWOW64\ynmdqylo.exe	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
File opened for modification	C:\Windows\SysWOW64\cippbawyiztyj.exe	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
File created	C:\Windows\SysWOW64\kjyjyqemhk.exe	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
File created	C:\Windows\SysWOW64\ytsoguaehjnvoet.exe	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
File opened for modification	C:\Windows\SysWOW64\ytsoguaehjnvoet.exe	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
File created	C:\Windows\SysWOW64\ynmdqylo.exe	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
File created	C:\Windows\SysWOW64\cippbawyiztyj.exe	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	kjyjyqemhk.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ynmdqylo.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ynmdqylo.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ynmdqylo.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ynmdqylo.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ynmdqylo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ynmdqylo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	ynmdqylo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ynmdqylo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ynmdqylo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	ynmdqylo.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ynmdqylo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ynmdqylo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	ynmdqylo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	ynmdqylo.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ynmdqylo.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332C0D9D2083556D3577D170232CAC7D8664AD"	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBCF9B0FE11F196830C3A44869A3994B0FE02FE4366023FE1B8429E09D5"	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC2B15D47E3399F52CFB9A23299D7C9"	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	kjyjyqemhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	kjyjyqemhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	kjyjyqemhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1084	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
1724	kjyjyqemhk.exe
1724	kjyjyqemhk.exe
1724	kjyjyqemhk.exe
1724	kjyjyqemhk.exe
1724	kjyjyqemhk.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
976	ytsoguaehjnvoet.exe
976	ytsoguaehjnvoet.exe
976	ytsoguaehjnvoet.exe
976	ytsoguaehjnvoet.exe
976	ytsoguaehjnvoet.exe
956	ynmdqylo.exe
956	ynmdqylo.exe
956	ynmdqylo.exe
956	ynmdqylo.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
836	ynmdqylo.exe
836	ynmdqylo.exe
836	ynmdqylo.exe
836	ynmdqylo.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
976	ytsoguaehjnvoet.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
1724	kjyjyqemhk.exe
1724	kjyjyqemhk.exe
1724	kjyjyqemhk.exe
976	ytsoguaehjnvoet.exe
976	ytsoguaehjnvoet.exe
976	ytsoguaehjnvoet.exe
956	ynmdqylo.exe
956	ynmdqylo.exe
956	ynmdqylo.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
836	ynmdqylo.exe
836	ynmdqylo.exe
836	ynmdqylo.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
1724	kjyjyqemhk.exe
1724	kjyjyqemhk.exe
1724	kjyjyqemhk.exe
976	ytsoguaehjnvoet.exe
976	ytsoguaehjnvoet.exe
976	ytsoguaehjnvoet.exe
956	ynmdqylo.exe
956	ynmdqylo.exe
956	ynmdqylo.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
1480	cippbawyiztyj.exe
836	ynmdqylo.exe
836	ynmdqylo.exe
836	ynmdqylo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1084	WINWORD.EXE
1084	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1724	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	28
PID 288 wrote to memory of 1724	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	28
PID 288 wrote to memory of 1724	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	28
PID 288 wrote to memory of 1724	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	28
PID 288 wrote to memory of 976	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	29
PID 288 wrote to memory of 976	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	29
PID 288 wrote to memory of 976	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	29
PID 288 wrote to memory of 976	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	29
PID 288 wrote to memory of 956	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	30
PID 288 wrote to memory of 956	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	30
PID 288 wrote to memory of 956	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	30
PID 288 wrote to memory of 956	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	30
PID 288 wrote to memory of 1480	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	31
PID 288 wrote to memory of 1480	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	31
PID 288 wrote to memory of 1480	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	31
PID 288 wrote to memory of 1480	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	31
PID 1724 wrote to memory of 836	1724	kjyjyqemhk.exe	32
PID 1724 wrote to memory of 836	1724	kjyjyqemhk.exe	32
PID 1724 wrote to memory of 836	1724	kjyjyqemhk.exe	32
PID 1724 wrote to memory of 836	1724	kjyjyqemhk.exe	32
PID 288 wrote to memory of 1084	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	33
PID 288 wrote to memory of 1084	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	33
PID 288 wrote to memory of 1084	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	33
PID 288 wrote to memory of 1084	288	972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe	33
PID 1084 wrote to memory of 556	1084	WINWORD.EXE	36
PID 1084 wrote to memory of 556	1084	WINWORD.EXE	36
PID 1084 wrote to memory of 556	1084	WINWORD.EXE	36
PID 1084 wrote to memory of 556	1084	WINWORD.EXE	36

C:\Users\Admin\AppData\Local\Temp\972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe
"C:\Users\Admin\AppData\Local\Temp\972332a1293822f3c16ad8348e11707256437326aa36929cd6f8c1ce32f45de2.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\kjyjyqemhk.exe
  kjyjyqemhk.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\ynmdqylo.exe
    C:\Windows\system32\ynmdqylo.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:836
- C:\Windows\SysWOW64\ytsoguaehjnvoet.exe
  ytsoguaehjnvoet.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:976
- C:\Windows\SysWOW64\ynmdqylo.exe
  ynmdqylo.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:956
- C:\Windows\SysWOW64\cippbawyiztyj.exe
  cippbawyiztyj.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1480
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Downloads\SwitchWrite.doc.exe

Filesize
255KB

MD5
7855b61469c4f96c851432a6ea300cd9

SHA1
5e22c232f4ab1fd6e71f7a64412a4ae7790c4cf0

SHA256
dbf431b6cd3e7b805ad4f1ec568ee8388b4d7015229b4300e45c05a09a4e9b92

SHA512
3deb818ee60e4bb2d1ae9e7aab03f12842e77e2ef140ded668bd42593a6e37f887a28e0de0fa3fb8f59c2264b872e3a7e8e1aef9f72a7022652bf23a334f9eee

Download Submit
C:\Windows\SysWOW64\cippbawyiztyj.exe

Filesize
255KB

MD5
36a786ce9614ebff225128ee0be0a408

SHA1
5b0cbc53f12085eb5a7893d6d75bb967525c60b6

SHA256
864952df1084cbe09f4b18f79236d19a1f9e5765b3db40875b08b8b762718e0f

SHA512
537ef9ea92aa06b1b8abe63f087432f97df5c08d33992d42fdfe47176ad1ed2b6ac2a75284668becd3ec47ebec45218958ec7788d456367fb7ed9a092f903983

Download Submit
C:\Windows\SysWOW64\cippbawyiztyj.exe

Filesize
255KB

MD5
36a786ce9614ebff225128ee0be0a408

SHA1
5b0cbc53f12085eb5a7893d6d75bb967525c60b6

SHA256
864952df1084cbe09f4b18f79236d19a1f9e5765b3db40875b08b8b762718e0f

SHA512
537ef9ea92aa06b1b8abe63f087432f97df5c08d33992d42fdfe47176ad1ed2b6ac2a75284668becd3ec47ebec45218958ec7788d456367fb7ed9a092f903983

Download Submit
C:\Windows\SysWOW64\kjyjyqemhk.exe

Filesize
255KB

MD5
0acde95ec1a617113e09f86f69cd2742

SHA1
10faf18dd7cf3bd49ce815ad1dceb0d699eef6c1

SHA256
a900680832a65a585a67934ffac15685a193108ae61492a16be0a3f8eea7977c

SHA512
cd211befbbecaaecb768ecb6ad793562c6aa0bfc11d90d79b38ea1b1f93cebc5332306f7c2b617302ad7784f564cc9d86cbb9e313128a8c6c3fc4bed3ea205a5

Download Submit
C:\Windows\SysWOW64\kjyjyqemhk.exe

Filesize
255KB

MD5
0acde95ec1a617113e09f86f69cd2742

SHA1
10faf18dd7cf3bd49ce815ad1dceb0d699eef6c1

SHA256
a900680832a65a585a67934ffac15685a193108ae61492a16be0a3f8eea7977c

SHA512
cd211befbbecaaecb768ecb6ad793562c6aa0bfc11d90d79b38ea1b1f93cebc5332306f7c2b617302ad7784f564cc9d86cbb9e313128a8c6c3fc4bed3ea205a5

Download Submit
C:\Windows\SysWOW64\ynmdqylo.exe

Filesize
255KB

MD5
43ef85d6ad3b908167514b14e40400db

SHA1
50ea5f54687358b32c4a4cde134266f01ecf910f

SHA256
b6d162ed3a7bc371d59a033e198909f625627e3f82b1dbdec6ef2f3d8ab179f5

SHA512
79464237277123af3a47ed0ec36e03af33a656d94db486ac01c287a470a167773c3345bc8b54a658336f467464cbb1932823499fdb1274b52839908e0ebe5627

Download Submit
C:\Windows\SysWOW64\ynmdqylo.exe

Filesize
255KB

MD5
43ef85d6ad3b908167514b14e40400db

SHA1
50ea5f54687358b32c4a4cde134266f01ecf910f

SHA256
b6d162ed3a7bc371d59a033e198909f625627e3f82b1dbdec6ef2f3d8ab179f5

SHA512
79464237277123af3a47ed0ec36e03af33a656d94db486ac01c287a470a167773c3345bc8b54a658336f467464cbb1932823499fdb1274b52839908e0ebe5627

Download Submit
C:\Windows\SysWOW64\ynmdqylo.exe

Filesize
255KB

MD5
43ef85d6ad3b908167514b14e40400db

SHA1
50ea5f54687358b32c4a4cde134266f01ecf910f

SHA256
b6d162ed3a7bc371d59a033e198909f625627e3f82b1dbdec6ef2f3d8ab179f5

SHA512
79464237277123af3a47ed0ec36e03af33a656d94db486ac01c287a470a167773c3345bc8b54a658336f467464cbb1932823499fdb1274b52839908e0ebe5627

Download Submit
C:\Windows\SysWOW64\ytsoguaehjnvoet.exe

Filesize
255KB

MD5
5ce0304aba8a95b3d9d88e94a05538d1

SHA1
b33e3ee14623db95d7ac9d0138a5af87814c71e2

SHA256
66c35efe331b5c22f5d540bf782c4b9db2f615ac1d422f69399aac0779d69f29

SHA512
955beb542bbdd3f1527933932b821d8dcfd3abee720f7ab14040c9103d95493e9873d0a51104c9d1b6b7f1f546f82e25ebbb6cd7120e2a683a26e8b915096c35

Download Submit
C:\Windows\SysWOW64\ytsoguaehjnvoet.exe

Filesize
255KB

MD5
5ce0304aba8a95b3d9d88e94a05538d1

SHA1
b33e3ee14623db95d7ac9d0138a5af87814c71e2

SHA256
66c35efe331b5c22f5d540bf782c4b9db2f615ac1d422f69399aac0779d69f29

SHA512
955beb542bbdd3f1527933932b821d8dcfd3abee720f7ab14040c9103d95493e9873d0a51104c9d1b6b7f1f546f82e25ebbb6cd7120e2a683a26e8b915096c35

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\cippbawyiztyj.exe

Filesize
255KB

MD5
36a786ce9614ebff225128ee0be0a408

SHA1
5b0cbc53f12085eb5a7893d6d75bb967525c60b6

SHA256
864952df1084cbe09f4b18f79236d19a1f9e5765b3db40875b08b8b762718e0f

SHA512
537ef9ea92aa06b1b8abe63f087432f97df5c08d33992d42fdfe47176ad1ed2b6ac2a75284668becd3ec47ebec45218958ec7788d456367fb7ed9a092f903983

Download Submit
\Windows\SysWOW64\kjyjyqemhk.exe

Filesize
255KB

MD5
0acde95ec1a617113e09f86f69cd2742

SHA1
10faf18dd7cf3bd49ce815ad1dceb0d699eef6c1

SHA256
a900680832a65a585a67934ffac15685a193108ae61492a16be0a3f8eea7977c

SHA512
cd211befbbecaaecb768ecb6ad793562c6aa0bfc11d90d79b38ea1b1f93cebc5332306f7c2b617302ad7784f564cc9d86cbb9e313128a8c6c3fc4bed3ea205a5

Download Submit
\Windows\SysWOW64\ynmdqylo.exe

Filesize
255KB

MD5
43ef85d6ad3b908167514b14e40400db

SHA1
50ea5f54687358b32c4a4cde134266f01ecf910f

SHA256
b6d162ed3a7bc371d59a033e198909f625627e3f82b1dbdec6ef2f3d8ab179f5

SHA512
79464237277123af3a47ed0ec36e03af33a656d94db486ac01c287a470a167773c3345bc8b54a658336f467464cbb1932823499fdb1274b52839908e0ebe5627

Download Submit
\Windows\SysWOW64\ynmdqylo.exe

Filesize
255KB

MD5
43ef85d6ad3b908167514b14e40400db

SHA1
50ea5f54687358b32c4a4cde134266f01ecf910f

SHA256
b6d162ed3a7bc371d59a033e198909f625627e3f82b1dbdec6ef2f3d8ab179f5

SHA512
79464237277123af3a47ed0ec36e03af33a656d94db486ac01c287a470a167773c3345bc8b54a658336f467464cbb1932823499fdb1274b52839908e0ebe5627

Download Submit
\Windows\SysWOW64\ytsoguaehjnvoet.exe

Filesize
255KB

MD5
5ce0304aba8a95b3d9d88e94a05538d1

SHA1
b33e3ee14623db95d7ac9d0138a5af87814c71e2

SHA256
66c35efe331b5c22f5d540bf782c4b9db2f615ac1d422f69399aac0779d69f29

SHA512
955beb542bbdd3f1527933932b821d8dcfd3abee720f7ab14040c9103d95493e9873d0a51104c9d1b6b7f1f546f82e25ebbb6cd7120e2a683a26e8b915096c35

Download Submit
memory/288-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/288-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/288-78-0x00000000033E0000-0x0000000003480000-memory.dmp

Filesize
640KB

Download
memory/288-56-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/288-57-0x00000000033E0000-0x0000000003480000-memory.dmp

Filesize
640KB

Download
memory/556-103-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download
memory/556-102-0x0000000000000000-mapping.dmp

Download
memory/836-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/836-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/836-83-0x0000000000000000-mapping.dmp

Download
memory/956-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/956-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/956-67-0x0000000000000000-mapping.dmp

Download
memory/976-63-0x0000000000000000-mapping.dmp

Download
memory/976-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/976-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1084-94-0x00000000711BD000-0x00000000711C8000-memory.dmp

Filesize
44KB

Download
memory/1084-90-0x00000000701D1000-0x00000000701D3000-memory.dmp

Filesize
8KB

Download
memory/1084-106-0x00000000711BD000-0x00000000711C8000-memory.dmp

Filesize
44KB

Download
memory/1084-89-0x0000000072751000-0x0000000072754000-memory.dmp

Filesize
12KB

Download
memory/1084-86-0x0000000000000000-mapping.dmp

Download
memory/1084-91-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1084-105-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1084-101-0x00000000711BD000-0x00000000711C8000-memory.dmp

Filesize
44KB

Download
memory/1480-72-0x0000000000000000-mapping.dmp

Download
memory/1480-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1480-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1724-99-0x0000000003880000-0x0000000003920000-memory.dmp

Filesize
640KB

Download
memory/1724-58-0x0000000000000000-mapping.dmp

Download
memory/1724-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1724-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download