e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad

Analysis

max time kernel
151s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
Size

255KB
MD5

66325741c41537be5dea5191258de684
SHA1

411fc09f90a75a8e8707fd611659a34b75e8572b
SHA256

e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad
SHA512

a3c276afc37361bd40fa39327647c292281feb4d62b87bf8a47ac3da5730475238588a855128e9d3880e16599883705f94776b85ceeff052814dd82142eaee17
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ3:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIE

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	bpbcddzwql.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bpbcddzwql.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bpbcddzwql.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bpbcddzwql.exe

Executes dropped EXE 5 IoCs

pid	Process
804	bpbcddzwql.exe
552	vpoggymtuwpxnkr.exe
1148	smgrrqjr.exe
872	dlufvofwninmc.exe
984	smgrrqjr.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1712-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0008000000005c51-56.dat	upx
behavioral1/files/0x0008000000005c51-58.dat	upx
behavioral1/files/0x00080000000142c8-61.dat	upx
behavioral1/files/0x0008000000005c51-60.dat	upx
behavioral1/files/0x00080000000142c8-63.dat	upx
behavioral1/files/0x00070000000144ba-65.dat	upx
behavioral1/files/0x00080000000142c8-66.dat	upx
behavioral1/files/0x00070000000144ba-68.dat	upx
behavioral1/files/0x000600000001460b-69.dat	upx
behavioral1/files/0x000600000001460b-72.dat	upx
behavioral1/files/0x00070000000144ba-74.dat	upx
behavioral1/files/0x000600000001460b-75.dat	upx
behavioral1/memory/804-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/552-78-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1148-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/872-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00070000000144ba-81.dat	upx
behavioral1/files/0x00070000000144ba-83.dat	upx
behavioral1/memory/984-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1712-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/804-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/552-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/872-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1148-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/984-101-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0006000000015648-102.dat	upx
behavioral1/files/0x0006000000015c07-103.dat	upx
behavioral1/files/0x0006000000015c1d-104.dat	upx
behavioral1/files/0x0006000000015c2b-105.dat	upx
behavioral1/memory/1148-108-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/984-107-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 5 IoCs

pid	Process
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
804	bpbcddzwql.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bpbcddzwql.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vpoggymtuwpxnkr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uabbeylb = "bpbcddzwql.exe"	vpoggymtuwpxnkr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\glzclhij = "vpoggymtuwpxnkr.exe"	vpoggymtuwpxnkr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "dlufvofwninmc.exe"	vpoggymtuwpxnkr.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	bpbcddzwql.exe
File opened (read-only)	\??\t:	bpbcddzwql.exe
File opened (read-only)	\??\t:	smgrrqjr.exe
File opened (read-only)	\??\e:	smgrrqjr.exe
File opened (read-only)	\??\x:	smgrrqjr.exe
File opened (read-only)	\??\l:	smgrrqjr.exe
File opened (read-only)	\??\o:	smgrrqjr.exe
File opened (read-only)	\??\q:	smgrrqjr.exe
File opened (read-only)	\??\b:	smgrrqjr.exe
File opened (read-only)	\??\f:	smgrrqjr.exe
File opened (read-only)	\??\m:	smgrrqjr.exe
File opened (read-only)	\??\e:	bpbcddzwql.exe
File opened (read-only)	\??\u:	smgrrqjr.exe
File opened (read-only)	\??\b:	smgrrqjr.exe
File opened (read-only)	\??\u:	smgrrqjr.exe
File opened (read-only)	\??\q:	smgrrqjr.exe
File opened (read-only)	\??\x:	smgrrqjr.exe
File opened (read-only)	\??\b:	bpbcddzwql.exe
File opened (read-only)	\??\k:	bpbcddzwql.exe
File opened (read-only)	\??\a:	smgrrqjr.exe
File opened (read-only)	\??\w:	bpbcddzwql.exe
File opened (read-only)	\??\v:	smgrrqjr.exe
File opened (read-only)	\??\j:	smgrrqjr.exe
File opened (read-only)	\??\p:	smgrrqjr.exe
File opened (read-only)	\??\s:	bpbcddzwql.exe
File opened (read-only)	\??\z:	bpbcddzwql.exe
File opened (read-only)	\??\l:	bpbcddzwql.exe
File opened (read-only)	\??\x:	bpbcddzwql.exe
File opened (read-only)	\??\y:	smgrrqjr.exe
File opened (read-only)	\??\p:	smgrrqjr.exe
File opened (read-only)	\??\z:	smgrrqjr.exe
File opened (read-only)	\??\f:	bpbcddzwql.exe
File opened (read-only)	\??\g:	bpbcddzwql.exe
File opened (read-only)	\??\h:	bpbcddzwql.exe
File opened (read-only)	\??\i:	bpbcddzwql.exe
File opened (read-only)	\??\n:	bpbcddzwql.exe
File opened (read-only)	\??\y:	bpbcddzwql.exe
File opened (read-only)	\??\n:	smgrrqjr.exe
File opened (read-only)	\??\t:	smgrrqjr.exe
File opened (read-only)	\??\j:	bpbcddzwql.exe
File opened (read-only)	\??\f:	smgrrqjr.exe
File opened (read-only)	\??\g:	smgrrqjr.exe
File opened (read-only)	\??\r:	smgrrqjr.exe
File opened (read-only)	\??\h:	smgrrqjr.exe
File opened (read-only)	\??\i:	smgrrqjr.exe
File opened (read-only)	\??\r:	smgrrqjr.exe
File opened (read-only)	\??\s:	smgrrqjr.exe
File opened (read-only)	\??\s:	smgrrqjr.exe
File opened (read-only)	\??\e:	smgrrqjr.exe
File opened (read-only)	\??\w:	smgrrqjr.exe
File opened (read-only)	\??\m:	bpbcddzwql.exe
File opened (read-only)	\??\m:	smgrrqjr.exe
File opened (read-only)	\??\l:	smgrrqjr.exe
File opened (read-only)	\??\o:	smgrrqjr.exe
File opened (read-only)	\??\z:	smgrrqjr.exe
File opened (read-only)	\??\a:	smgrrqjr.exe
File opened (read-only)	\??\r:	bpbcddzwql.exe
File opened (read-only)	\??\u:	bpbcddzwql.exe
File opened (read-only)	\??\i:	smgrrqjr.exe
File opened (read-only)	\??\n:	smgrrqjr.exe
File opened (read-only)	\??\y:	smgrrqjr.exe
File opened (read-only)	\??\p:	bpbcddzwql.exe
File opened (read-only)	\??\q:	bpbcddzwql.exe
File opened (read-only)	\??\v:	smgrrqjr.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	bpbcddzwql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	bpbcddzwql.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1712-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/804-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/552-78-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1148-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/872-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/984-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1712-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/804-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/552-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/872-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1148-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/984-101-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1148-108-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/984-107-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dlufvofwninmc.exe	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	bpbcddzwql.exe
File created	C:\Windows\SysWOW64\bpbcddzwql.exe	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
File opened for modification	C:\Windows\SysWOW64\bpbcddzwql.exe	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
File opened for modification	C:\Windows\SysWOW64\vpoggymtuwpxnkr.exe	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
File created	C:\Windows\SysWOW64\smgrrqjr.exe	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
File opened for modification	C:\Windows\SysWOW64\smgrrqjr.exe	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
File created	C:\Windows\SysWOW64\vpoggymtuwpxnkr.exe	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
File created	C:\Windows\SysWOW64\dlufvofwninmc.exe	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	smgrrqjr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	smgrrqjr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	smgrrqjr.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	smgrrqjr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	smgrrqjr.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	smgrrqjr.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	smgrrqjr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	smgrrqjr.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	smgrrqjr.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	smgrrqjr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	smgrrqjr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	smgrrqjr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	smgrrqjr.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	smgrrqjr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	smgrrqjr.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico	explorer.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	bpbcddzwql.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	bpbcddzwql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F46BB4FE6621DAD20CD1A78A759113"	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	bpbcddzwql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	bpbcddzwql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	bpbcddzwql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB1B15C4790389952CCB9D3329FD4C4"	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
676	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
804	bpbcddzwql.exe
804	bpbcddzwql.exe
804	bpbcddzwql.exe
804	bpbcddzwql.exe
804	bpbcddzwql.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
1148	smgrrqjr.exe
1148	smgrrqjr.exe
1148	smgrrqjr.exe
1148	smgrrqjr.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
984	smgrrqjr.exe
984	smgrrqjr.exe
984	smgrrqjr.exe
984	smgrrqjr.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
552	vpoggymtuwpxnkr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: 33	540	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	540	AUDIODG.EXE
Token: 33	540	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	540	AUDIODG.EXE
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe
Token: SeShutdownPrivilege	1216	explorer.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
804	bpbcddzwql.exe
804	bpbcddzwql.exe
804	bpbcddzwql.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
1148	smgrrqjr.exe
872	dlufvofwninmc.exe
1148	smgrrqjr.exe
1148	smgrrqjr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
984	smgrrqjr.exe
984	smgrrqjr.exe
984	smgrrqjr.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
804	bpbcddzwql.exe
804	bpbcddzwql.exe
804	bpbcddzwql.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
552	vpoggymtuwpxnkr.exe
1148	smgrrqjr.exe
1148	smgrrqjr.exe
1148	smgrrqjr.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
872	dlufvofwninmc.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe
1216	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
676	WINWORD.EXE
676	WINWORD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 804	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	27
PID 1712 wrote to memory of 804	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	27
PID 1712 wrote to memory of 804	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	27
PID 1712 wrote to memory of 804	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	27
PID 1712 wrote to memory of 552	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	28
PID 1712 wrote to memory of 552	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	28
PID 1712 wrote to memory of 552	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	28
PID 1712 wrote to memory of 552	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	28
PID 1712 wrote to memory of 1148	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	29
PID 1712 wrote to memory of 1148	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	29
PID 1712 wrote to memory of 1148	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	29
PID 1712 wrote to memory of 1148	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	29
PID 1712 wrote to memory of 872	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	30
PID 1712 wrote to memory of 872	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	30
PID 1712 wrote to memory of 872	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	30
PID 1712 wrote to memory of 872	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	30
PID 804 wrote to memory of 984	804	bpbcddzwql.exe	31
PID 804 wrote to memory of 984	804	bpbcddzwql.exe	31
PID 804 wrote to memory of 984	804	bpbcddzwql.exe	31
PID 804 wrote to memory of 984	804	bpbcddzwql.exe	31
PID 1712 wrote to memory of 676	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	32
PID 1712 wrote to memory of 676	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	32
PID 1712 wrote to memory of 676	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	32
PID 1712 wrote to memory of 676	1712	e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe	32

C:\Users\Admin\AppData\Local\Temp\e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe
"C:\Users\Admin\AppData\Local\Temp\e547ef098e13e08f460bec2084d52ecdf917c09335b127230e8d3d46d8de7aad.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\bpbcddzwql.exe
  bpbcddzwql.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\smgrrqjr.exe
    C:\Windows\system32\smgrrqjr.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:984
- C:\Windows\SysWOW64\vpoggymtuwpxnkr.exe
  vpoggymtuwpxnkr.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:552
- C:\Windows\SysWOW64\smgrrqjr.exe
  smgrrqjr.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1148
- C:\Windows\SysWOW64\dlufvofwninmc.exe
  dlufvofwninmc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:872
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:676

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1216

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5a8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
a75256733f1838ac6311a9224aba6044

SHA1
b17fd85b9adea78063c562fb384e21e0ee0543cf

SHA256
5783e882fdd7681055d9935af317fd079a2b4de4c609dd16eff4b03cb20dc714

SHA512
2a9f94fcd6999b865fe796abd4300cadc6c6f9cfd502194499e2e984760704dfcec7a8bf6845512eef96a8b5ec76b0020337ee46a52308b19790c7b338476c58

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
6581f361d1df31857177c4160c05ee33

SHA1
1fd76b42079e28c635664feadeaf11b9310e39e3

SHA256
05f63c15024c0fda353ed1517878ee4b467822cbbc13abfea70b14cd27c50632

SHA512
8d649af63d2a0aecb2f9fbbd7f6219970757a5fa7c3c8e20161eef064abd32bc3a9ae3397fd24de4fcb3cc6ab90308e7a5e8bc0ded456033412c8396ef8b7e57

Download Submit
C:\Users\Admin\AppData\Roaming\OpenStart.doc.exe

Filesize
255KB

MD5
92314016e079020a3928d58041019125

SHA1
c5d5b68315c0e6e41b9e804ccfa55367124b92bc

SHA256
daf0373ef093fd1367dbea6cf06abdf76d06e227368709aace7609f8879e7f4c

SHA512
e798b77c1eed3518ab20a36e3ccdfb22de944a91ea878f25d57a428f72172a950f3d0e7b92820e85a187ad0046028cb107ea0d8bb6b13ad10a4838208bef94af

Download Submit
C:\Users\Admin\Downloads\JoinExport.doc.exe

Filesize
255KB

MD5
d930a18521eba4f5ff5a3048b4a9e429

SHA1
af368af58efc1bb2c2a1b5fb94c734a696d2e680

SHA256
e5ab010ef126c978f64f301d931dea14d163ce8a300b758825e2c2377e9b6440

SHA512
f2b6afca5d9ba013b67320efb2554aa5a0afbe9e30adae1f798e6c9b3fb1a96a26492d69af91381b3a59052f77948474bc1603ec139db9d06d62337131f33eb2

Download Submit
C:\Windows\SysWOW64\bpbcddzwql.exe

Filesize
255KB

MD5
85f2cf92422a591fd137b32c5dfc325e

SHA1
7a37489419edfeefd70411d19c94dd50b6cd9501

SHA256
763baae2a4f5768511f93109899f04b74530c4b7748b3fb1f9cc6e5b42a36932

SHA512
640e5ca27ebf942773bebf90bcc16338db9f092272d3a16926e82a8dd1885c37328d4408204c3eed7c4e84a6effe508637255a41e08fa0583d06c04cca993e06

Download Submit
C:\Windows\SysWOW64\bpbcddzwql.exe

Filesize
255KB

MD5
85f2cf92422a591fd137b32c5dfc325e

SHA1
7a37489419edfeefd70411d19c94dd50b6cd9501

SHA256
763baae2a4f5768511f93109899f04b74530c4b7748b3fb1f9cc6e5b42a36932

SHA512
640e5ca27ebf942773bebf90bcc16338db9f092272d3a16926e82a8dd1885c37328d4408204c3eed7c4e84a6effe508637255a41e08fa0583d06c04cca993e06

Download Submit
C:\Windows\SysWOW64\dlufvofwninmc.exe

Filesize
255KB

MD5
81cd5ac9d8ad3c7349b426d60cea4d7b

SHA1
1de958132f1901abbc014192082beb0943258207

SHA256
5176bf5c162483150f0895dbc92cbb97369b5310f8e763544a0804a1d6989db9

SHA512
e5aff5f8a024afd2739fa92d9579a8df1aabce178f8243c1040311c2cee178a2fc8024d22c0a55f20906b50a67b65e516faa0f00fe43980d2572e5b9ed271a85

Download Submit
C:\Windows\SysWOW64\dlufvofwninmc.exe

Filesize
255KB

MD5
81cd5ac9d8ad3c7349b426d60cea4d7b

SHA1
1de958132f1901abbc014192082beb0943258207

SHA256
5176bf5c162483150f0895dbc92cbb97369b5310f8e763544a0804a1d6989db9

SHA512
e5aff5f8a024afd2739fa92d9579a8df1aabce178f8243c1040311c2cee178a2fc8024d22c0a55f20906b50a67b65e516faa0f00fe43980d2572e5b9ed271a85

Download Submit
C:\Windows\SysWOW64\smgrrqjr.exe

Filesize
255KB

MD5
3ea660013035673fe8f3ffb1547ced2e

SHA1
92c426b25c00139017d7b3b43eaf3e085077fe75

SHA256
b82cf25b5c117e30d1ee4a4af002ce4ee8940a9947f7838ed17d098f49254810

SHA512
6d3000ef6b1f901c50ac99b3224d236cbda0b31553aafaa1cff7ee3afc6c3d469dd9713966adb70e94132b5dfc9b0507f96f65409f0945b11dd2ab928f028e78

Download Submit
C:\Windows\SysWOW64\smgrrqjr.exe

Filesize
255KB

MD5
3ea660013035673fe8f3ffb1547ced2e

SHA1
92c426b25c00139017d7b3b43eaf3e085077fe75

SHA256
b82cf25b5c117e30d1ee4a4af002ce4ee8940a9947f7838ed17d098f49254810

SHA512
6d3000ef6b1f901c50ac99b3224d236cbda0b31553aafaa1cff7ee3afc6c3d469dd9713966adb70e94132b5dfc9b0507f96f65409f0945b11dd2ab928f028e78

Download Submit
C:\Windows\SysWOW64\smgrrqjr.exe

Filesize
255KB

MD5
3ea660013035673fe8f3ffb1547ced2e

SHA1
92c426b25c00139017d7b3b43eaf3e085077fe75

SHA256
b82cf25b5c117e30d1ee4a4af002ce4ee8940a9947f7838ed17d098f49254810

SHA512
6d3000ef6b1f901c50ac99b3224d236cbda0b31553aafaa1cff7ee3afc6c3d469dd9713966adb70e94132b5dfc9b0507f96f65409f0945b11dd2ab928f028e78

Download Submit
C:\Windows\SysWOW64\vpoggymtuwpxnkr.exe

Filesize
255KB

MD5
d3933334523358ec90e9e82ce019b178

SHA1
e40899650a16999a677a37b1bb794913196cf3bb

SHA256
48cf971c7846f360dfd7eee3676a553776d178b1cb0f1860f4964b888844d2c9

SHA512
9147dc251e45fbf0e3dcd379b040232c32155b2f98902eb59faeb4f54acea6b9cfbe8fc2811215fb6fbcfcc7218fb4a33750579edb5f092d99f643dd6d04bd0e

Download Submit
C:\Windows\SysWOW64\vpoggymtuwpxnkr.exe

Filesize
255KB

MD5
d3933334523358ec90e9e82ce019b178

SHA1
e40899650a16999a677a37b1bb794913196cf3bb

SHA256
48cf971c7846f360dfd7eee3676a553776d178b1cb0f1860f4964b888844d2c9

SHA512
9147dc251e45fbf0e3dcd379b040232c32155b2f98902eb59faeb4f54acea6b9cfbe8fc2811215fb6fbcfcc7218fb4a33750579edb5f092d99f643dd6d04bd0e

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\bpbcddzwql.exe

Filesize
255KB

MD5
85f2cf92422a591fd137b32c5dfc325e

SHA1
7a37489419edfeefd70411d19c94dd50b6cd9501

SHA256
763baae2a4f5768511f93109899f04b74530c4b7748b3fb1f9cc6e5b42a36932

SHA512
640e5ca27ebf942773bebf90bcc16338db9f092272d3a16926e82a8dd1885c37328d4408204c3eed7c4e84a6effe508637255a41e08fa0583d06c04cca993e06

Download Submit
\Windows\SysWOW64\dlufvofwninmc.exe

Filesize
255KB

MD5
81cd5ac9d8ad3c7349b426d60cea4d7b

SHA1
1de958132f1901abbc014192082beb0943258207

SHA256
5176bf5c162483150f0895dbc92cbb97369b5310f8e763544a0804a1d6989db9

SHA512
e5aff5f8a024afd2739fa92d9579a8df1aabce178f8243c1040311c2cee178a2fc8024d22c0a55f20906b50a67b65e516faa0f00fe43980d2572e5b9ed271a85

Download Submit
\Windows\SysWOW64\smgrrqjr.exe

Filesize
255KB

MD5
3ea660013035673fe8f3ffb1547ced2e

SHA1
92c426b25c00139017d7b3b43eaf3e085077fe75

SHA256
b82cf25b5c117e30d1ee4a4af002ce4ee8940a9947f7838ed17d098f49254810

SHA512
6d3000ef6b1f901c50ac99b3224d236cbda0b31553aafaa1cff7ee3afc6c3d469dd9713966adb70e94132b5dfc9b0507f96f65409f0945b11dd2ab928f028e78

Download Submit
\Windows\SysWOW64\smgrrqjr.exe

Filesize
255KB

MD5
3ea660013035673fe8f3ffb1547ced2e

SHA1
92c426b25c00139017d7b3b43eaf3e085077fe75

SHA256
b82cf25b5c117e30d1ee4a4af002ce4ee8940a9947f7838ed17d098f49254810

SHA512
6d3000ef6b1f901c50ac99b3224d236cbda0b31553aafaa1cff7ee3afc6c3d469dd9713966adb70e94132b5dfc9b0507f96f65409f0945b11dd2ab928f028e78

Download Submit
\Windows\SysWOW64\vpoggymtuwpxnkr.exe

Filesize
255KB

MD5
d3933334523358ec90e9e82ce019b178

SHA1
e40899650a16999a677a37b1bb794913196cf3bb

SHA256
48cf971c7846f360dfd7eee3676a553776d178b1cb0f1860f4964b888844d2c9

SHA512
9147dc251e45fbf0e3dcd379b040232c32155b2f98902eb59faeb4f54acea6b9cfbe8fc2811215fb6fbcfcc7218fb4a33750579edb5f092d99f643dd6d04bd0e

Download Submit
memory/552-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/552-78-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/676-89-0x0000000072A01000-0x0000000072A04000-memory.dmp

Filesize
12KB

Download
memory/676-95-0x000000007146D000-0x0000000071478000-memory.dmp

Filesize
44KB

Download
memory/676-92-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/676-106-0x000000007146D000-0x0000000071478000-memory.dmp

Filesize
44KB

Download
memory/676-90-0x0000000070481000-0x0000000070483000-memory.dmp

Filesize
8KB

Download
memory/804-100-0x0000000003CD0000-0x0000000003D70000-memory.dmp

Filesize
640KB

Download
memory/804-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/804-85-0x0000000003CD0000-0x0000000003D70000-memory.dmp

Filesize
640KB

Download
memory/804-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/872-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/872-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/984-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/984-101-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/984-107-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1148-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1148-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1148-108-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1216-91-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmp

Filesize
8KB

Download
memory/1216-109-0x0000000002610000-0x0000000002620000-memory.dmp

Filesize
64KB

Download
memory/1712-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1712-76-0x0000000002F80000-0x0000000003020000-memory.dmp

Filesize
640KB

Download
memory/1712-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

Filesize
8KB

Download
memory/1712-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download