Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:02
Behavioral task
behavioral1
Sample
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe
Resource
win10v2004-20221111-en
General
-
Target
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe
-
Size
255KB
-
MD5
1fa7b053eb181dfa0c1632fb7a8eab99
-
SHA1
bad62dbd43017abc28d42ec120f30b19c3d7dab8
-
SHA256
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d
-
SHA512
fd471195b9c47ef3649eb40a5102fce146e323ce1cf071d28138016749759032281dfbd7179845afe9b937369a961a6d346a665c96e5424fc03c11ef49cd6e57
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJh:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIU
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
vlrwkbnpwp.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" vlrwkbnpwp.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
vlrwkbnpwp.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" vlrwkbnpwp.exe -
Processes:
vlrwkbnpwp.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vlrwkbnpwp.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
vlrwkbnpwp.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vlrwkbnpwp.exe -
Executes dropped EXE 6 IoCs
Processes:
vlrwkbnpwp.exewyvypxdzedztjdx.exejpfhaiie.exeiklworckwlyhi.exeiklworckwlyhi.exejpfhaiie.exepid process 2028 vlrwkbnpwp.exe 1744 wyvypxdzedztjdx.exe 1520 jpfhaiie.exe 1724 iklworckwlyhi.exe 468 iklworckwlyhi.exe 660 jpfhaiie.exe -
Processes:
resource yara_rule \Windows\SysWOW64\vlrwkbnpwp.exe upx behavioral1/memory/1080-56-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1080-57-0x0000000002FE0000-0x0000000003080000-memory.dmp upx C:\Windows\SysWOW64\vlrwkbnpwp.exe upx \Windows\SysWOW64\wyvypxdzedztjdx.exe upx C:\Windows\SysWOW64\wyvypxdzedztjdx.exe upx C:\Windows\SysWOW64\vlrwkbnpwp.exe upx C:\Windows\SysWOW64\wyvypxdzedztjdx.exe upx \Windows\SysWOW64\jpfhaiie.exe upx \Windows\SysWOW64\iklworckwlyhi.exe upx C:\Windows\SysWOW64\jpfhaiie.exe upx C:\Windows\SysWOW64\iklworckwlyhi.exe upx C:\Windows\SysWOW64\iklworckwlyhi.exe upx C:\Windows\SysWOW64\jpfhaiie.exe upx \Windows\SysWOW64\iklworckwlyhi.exe upx C:\Windows\SysWOW64\iklworckwlyhi.exe upx \Windows\SysWOW64\jpfhaiie.exe upx C:\Windows\SysWOW64\jpfhaiie.exe upx C:\Program Files\ExpandApprove.doc.exe upx behavioral1/memory/1080-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2028-90-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1744-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1520-92-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1724-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/468-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/660-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2028-101-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1744-102-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1520-103-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1724-104-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/468-105-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/660-107-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe upx C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe upx C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe upx -
Loads dropped DLL 6 IoCs
Processes:
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.execmd.exevlrwkbnpwp.exepid process 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1832 cmd.exe 2028 vlrwkbnpwp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
vlrwkbnpwp.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" vlrwkbnpwp.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wyvypxdzedztjdx.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "iklworckwlyhi.exe" wyvypxdzedztjdx.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wyvypxdzedztjdx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cljyhjkh = "vlrwkbnpwp.exe" wyvypxdzedztjdx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\jysjjsav = "wyvypxdzedztjdx.exe" wyvypxdzedztjdx.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
jpfhaiie.exevlrwkbnpwp.exejpfhaiie.exedescription ioc process File opened (read-only) \??\g: jpfhaiie.exe File opened (read-only) \??\z: jpfhaiie.exe File opened (read-only) \??\m: vlrwkbnpwp.exe File opened (read-only) \??\e: jpfhaiie.exe File opened (read-only) \??\u: jpfhaiie.exe File opened (read-only) \??\o: vlrwkbnpwp.exe File opened (read-only) \??\u: vlrwkbnpwp.exe File opened (read-only) \??\w: jpfhaiie.exe File opened (read-only) \??\z: jpfhaiie.exe File opened (read-only) \??\p: vlrwkbnpwp.exe File opened (read-only) \??\j: jpfhaiie.exe File opened (read-only) \??\w: jpfhaiie.exe File opened (read-only) \??\f: vlrwkbnpwp.exe File opened (read-only) \??\h: vlrwkbnpwp.exe File opened (read-only) \??\i: vlrwkbnpwp.exe File opened (read-only) \??\s: vlrwkbnpwp.exe File opened (read-only) \??\m: jpfhaiie.exe File opened (read-only) \??\a: jpfhaiie.exe File opened (read-only) \??\q: jpfhaiie.exe File opened (read-only) \??\y: jpfhaiie.exe File opened (read-only) \??\b: jpfhaiie.exe File opened (read-only) \??\o: jpfhaiie.exe File opened (read-only) \??\p: jpfhaiie.exe File opened (read-only) \??\t: jpfhaiie.exe File opened (read-only) \??\l: vlrwkbnpwp.exe File opened (read-only) \??\w: vlrwkbnpwp.exe File opened (read-only) \??\b: jpfhaiie.exe File opened (read-only) \??\s: jpfhaiie.exe File opened (read-only) \??\i: jpfhaiie.exe File opened (read-only) \??\o: jpfhaiie.exe File opened (read-only) \??\e: jpfhaiie.exe File opened (read-only) \??\h: jpfhaiie.exe File opened (read-only) \??\l: jpfhaiie.exe File opened (read-only) \??\j: vlrwkbnpwp.exe File opened (read-only) \??\n: vlrwkbnpwp.exe File opened (read-only) \??\x: vlrwkbnpwp.exe File opened (read-only) \??\r: jpfhaiie.exe File opened (read-only) \??\x: jpfhaiie.exe File opened (read-only) \??\j: jpfhaiie.exe File opened (read-only) \??\l: jpfhaiie.exe File opened (read-only) \??\n: jpfhaiie.exe File opened (read-only) \??\v: jpfhaiie.exe File opened (read-only) \??\k: vlrwkbnpwp.exe File opened (read-only) \??\h: jpfhaiie.exe File opened (read-only) \??\v: jpfhaiie.exe File opened (read-only) \??\v: vlrwkbnpwp.exe File opened (read-only) \??\y: vlrwkbnpwp.exe File opened (read-only) \??\z: vlrwkbnpwp.exe File opened (read-only) \??\p: jpfhaiie.exe File opened (read-only) \??\x: jpfhaiie.exe File opened (read-only) \??\f: jpfhaiie.exe File opened (read-only) \??\n: jpfhaiie.exe File opened (read-only) \??\s: jpfhaiie.exe File opened (read-only) \??\b: vlrwkbnpwp.exe File opened (read-only) \??\q: vlrwkbnpwp.exe File opened (read-only) \??\r: vlrwkbnpwp.exe File opened (read-only) \??\a: jpfhaiie.exe File opened (read-only) \??\k: jpfhaiie.exe File opened (read-only) \??\f: jpfhaiie.exe File opened (read-only) \??\i: jpfhaiie.exe File opened (read-only) \??\m: jpfhaiie.exe File opened (read-only) \??\r: jpfhaiie.exe File opened (read-only) \??\a: vlrwkbnpwp.exe File opened (read-only) \??\g: vlrwkbnpwp.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
vlrwkbnpwp.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" vlrwkbnpwp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" vlrwkbnpwp.exe -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1080-56-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1080-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2028-90-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1744-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1520-92-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1724-93-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/468-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/660-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2028-101-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1744-102-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1520-103-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1724-104-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/468-105-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/660-107-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exevlrwkbnpwp.exedescription ioc process File created C:\Windows\SysWOW64\wyvypxdzedztjdx.exe 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe File opened for modification C:\Windows\SysWOW64\jpfhaiie.exe 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe File created C:\Windows\SysWOW64\iklworckwlyhi.exe 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe File opened for modification C:\Windows\SysWOW64\vlrwkbnpwp.exe 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe File opened for modification C:\Windows\SysWOW64\wyvypxdzedztjdx.exe 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe File created C:\Windows\SysWOW64\jpfhaiie.exe 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe File opened for modification C:\Windows\SysWOW64\iklworckwlyhi.exe 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll vlrwkbnpwp.exe File created C:\Windows\SysWOW64\vlrwkbnpwp.exe 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe -
Drops file in Program Files directory 22 IoCs
Processes:
jpfhaiie.exejpfhaiie.exedescription ioc process File opened for modification C:\Program Files\ExpandApprove.doc.exe jpfhaiie.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe jpfhaiie.exe File created \??\c:\Program Files\ExpandApprove.doc.exe jpfhaiie.exe File opened for modification \??\c:\Program Files\ExpandApprove.doc.exe jpfhaiie.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe jpfhaiie.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe jpfhaiie.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe jpfhaiie.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe jpfhaiie.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe jpfhaiie.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal jpfhaiie.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe jpfhaiie.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal jpfhaiie.exe File opened for modification C:\Program Files\ExpandApprove.doc.exe jpfhaiie.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe jpfhaiie.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal jpfhaiie.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe jpfhaiie.exe File opened for modification \??\c:\Program Files\ExpandApprove.doc.exe jpfhaiie.exe File opened for modification C:\Program Files\ExpandApprove.nal jpfhaiie.exe File opened for modification C:\Program Files\ExpandApprove.nal jpfhaiie.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe jpfhaiie.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe jpfhaiie.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal jpfhaiie.exe -
Drops file in Windows directory 5 IoCs
Processes:
WINWORD.EXE9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEvlrwkbnpwp.exe9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg vlrwkbnpwp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC9F9BDFE6BF29084093A32869F3EE2B08A02F04262023DE1C4429D09A2" 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh vlrwkbnpwp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" vlrwkbnpwp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc vlrwkbnpwp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" vlrwkbnpwp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" vlrwkbnpwp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F26BB9FE6E22D1D278D0A48A0B9162" 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" vlrwkbnpwp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf vlrwkbnpwp.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1064 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exewyvypxdzedztjdx.exevlrwkbnpwp.exeiklworckwlyhi.exejpfhaiie.exeiklworckwlyhi.exejpfhaiie.exepid process 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1744 wyvypxdzedztjdx.exe 1744 wyvypxdzedztjdx.exe 1744 wyvypxdzedztjdx.exe 1744 wyvypxdzedztjdx.exe 1744 wyvypxdzedztjdx.exe 2028 vlrwkbnpwp.exe 2028 vlrwkbnpwp.exe 2028 vlrwkbnpwp.exe 2028 vlrwkbnpwp.exe 2028 vlrwkbnpwp.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 1520 jpfhaiie.exe 1520 jpfhaiie.exe 1520 jpfhaiie.exe 1520 jpfhaiie.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 660 jpfhaiie.exe 660 jpfhaiie.exe 660 jpfhaiie.exe 660 jpfhaiie.exe 1744 wyvypxdzedztjdx.exe 1744 wyvypxdzedztjdx.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 1744 wyvypxdzedztjdx.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 1744 wyvypxdzedztjdx.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 1744 wyvypxdzedztjdx.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 1744 wyvypxdzedztjdx.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
Processes:
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exevlrwkbnpwp.exewyvypxdzedztjdx.exeiklworckwlyhi.exejpfhaiie.exeiklworckwlyhi.exejpfhaiie.exepid process 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 2028 vlrwkbnpwp.exe 1744 wyvypxdzedztjdx.exe 1744 wyvypxdzedztjdx.exe 1744 wyvypxdzedztjdx.exe 2028 vlrwkbnpwp.exe 2028 vlrwkbnpwp.exe 1724 iklworckwlyhi.exe 1520 jpfhaiie.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 1520 jpfhaiie.exe 1520 jpfhaiie.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 660 jpfhaiie.exe 660 jpfhaiie.exe 660 jpfhaiie.exe -
Suspicious use of SendNotifyMessage 21 IoCs
Processes:
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exevlrwkbnpwp.exewyvypxdzedztjdx.exeiklworckwlyhi.exejpfhaiie.exeiklworckwlyhi.exejpfhaiie.exepid process 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe 2028 vlrwkbnpwp.exe 1744 wyvypxdzedztjdx.exe 1744 wyvypxdzedztjdx.exe 1744 wyvypxdzedztjdx.exe 2028 vlrwkbnpwp.exe 2028 vlrwkbnpwp.exe 1724 iklworckwlyhi.exe 1520 jpfhaiie.exe 1724 iklworckwlyhi.exe 1724 iklworckwlyhi.exe 1520 jpfhaiie.exe 1520 jpfhaiie.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 468 iklworckwlyhi.exe 660 jpfhaiie.exe 660 jpfhaiie.exe 660 jpfhaiie.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1064 WINWORD.EXE 1064 WINWORD.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exewyvypxdzedztjdx.execmd.exevlrwkbnpwp.exeWINWORD.EXEdescription pid process target process PID 1080 wrote to memory of 2028 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe vlrwkbnpwp.exe PID 1080 wrote to memory of 2028 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe vlrwkbnpwp.exe PID 1080 wrote to memory of 2028 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe vlrwkbnpwp.exe PID 1080 wrote to memory of 2028 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe vlrwkbnpwp.exe PID 1080 wrote to memory of 1744 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe wyvypxdzedztjdx.exe PID 1080 wrote to memory of 1744 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe wyvypxdzedztjdx.exe PID 1080 wrote to memory of 1744 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe wyvypxdzedztjdx.exe PID 1080 wrote to memory of 1744 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe wyvypxdzedztjdx.exe PID 1080 wrote to memory of 1520 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe jpfhaiie.exe PID 1080 wrote to memory of 1520 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe jpfhaiie.exe PID 1080 wrote to memory of 1520 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe jpfhaiie.exe PID 1080 wrote to memory of 1520 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe jpfhaiie.exe PID 1080 wrote to memory of 1724 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe iklworckwlyhi.exe PID 1080 wrote to memory of 1724 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe iklworckwlyhi.exe PID 1080 wrote to memory of 1724 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe iklworckwlyhi.exe PID 1080 wrote to memory of 1724 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe iklworckwlyhi.exe PID 1744 wrote to memory of 1832 1744 wyvypxdzedztjdx.exe cmd.exe PID 1744 wrote to memory of 1832 1744 wyvypxdzedztjdx.exe cmd.exe PID 1744 wrote to memory of 1832 1744 wyvypxdzedztjdx.exe cmd.exe PID 1744 wrote to memory of 1832 1744 wyvypxdzedztjdx.exe cmd.exe PID 1832 wrote to memory of 468 1832 cmd.exe iklworckwlyhi.exe PID 1832 wrote to memory of 468 1832 cmd.exe iklworckwlyhi.exe PID 1832 wrote to memory of 468 1832 cmd.exe iklworckwlyhi.exe PID 1832 wrote to memory of 468 1832 cmd.exe iklworckwlyhi.exe PID 2028 wrote to memory of 660 2028 vlrwkbnpwp.exe jpfhaiie.exe PID 2028 wrote to memory of 660 2028 vlrwkbnpwp.exe jpfhaiie.exe PID 2028 wrote to memory of 660 2028 vlrwkbnpwp.exe jpfhaiie.exe PID 2028 wrote to memory of 660 2028 vlrwkbnpwp.exe jpfhaiie.exe PID 1080 wrote to memory of 1064 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe WINWORD.EXE PID 1080 wrote to memory of 1064 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe WINWORD.EXE PID 1080 wrote to memory of 1064 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe WINWORD.EXE PID 1080 wrote to memory of 1064 1080 9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe WINWORD.EXE PID 1064 wrote to memory of 1584 1064 WINWORD.EXE splwow64.exe PID 1064 wrote to memory of 1584 1064 WINWORD.EXE splwow64.exe PID 1064 wrote to memory of 1584 1064 WINWORD.EXE splwow64.exe PID 1064 wrote to memory of 1584 1064 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe"C:\Users\Admin\AppData\Local\Temp\9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vlrwkbnpwp.exevlrwkbnpwp.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\jpfhaiie.exeC:\Windows\system32\jpfhaiie.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\wyvypxdzedztjdx.exewyvypxdzedztjdx.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c iklworckwlyhi.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iklworckwlyhi.exeiklworckwlyhi.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\jpfhaiie.exejpfhaiie.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\iklworckwlyhi.exeiklworckwlyhi.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
7Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exeFilesize
255KB
MD57da96b0ac574373b899c0a6f8f0a1c61
SHA1e95832761db371a8a6cb35c7eeb3323520c8caec
SHA2567669fb45a8f55c1862f3c857e4071f07d74f191b4ae8825d285135ba66145171
SHA512e0a673e9834a675731bbd57dadebba3d36c9d924b0e9e40b84d2b649ea006169cdc1c12680f8bdd7987e327d70ce4cb063f17cc56d40a5943f00a5da59fe7269
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exeFilesize
255KB
MD57da96b0ac574373b899c0a6f8f0a1c61
SHA1e95832761db371a8a6cb35c7eeb3323520c8caec
SHA2567669fb45a8f55c1862f3c857e4071f07d74f191b4ae8825d285135ba66145171
SHA512e0a673e9834a675731bbd57dadebba3d36c9d924b0e9e40b84d2b649ea006169cdc1c12680f8bdd7987e327d70ce4cb063f17cc56d40a5943f00a5da59fe7269
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exeFilesize
255KB
MD5e557f79539b496bd45f0e71768fc425a
SHA12e9115532476adde0a4329fec4ce6d7013b6a6c2
SHA2567351ef66ba312ccd03245b6bbd8d8e405ba265c71312e84ef2f5426ed32584e5
SHA51260363f2000e53c3781b3c0a16866e551b1ad3c97e1e92e6e5b13717cb0dd81064fce1c09e0dcae84eaede5410541be9ca8941b972882ae55bcc1201e2fce7bcc
-
C:\Program Files\ExpandApprove.doc.exeFilesize
255KB
MD526232f8241bdc5e0a6776faaa20feb19
SHA11559bbbf153b850396a9d28f7a50ea0159c95521
SHA25644a0f0d5586e04785bebe930ad81c008017ec88de1d4aebe28e0e6712e5e4afb
SHA5120b33cb6dc650bdd08261946a05edf9338ea3bed67ee801c94956fa7e44caed4b5e941743eeace369cd1f3a11dab1d78aa82e4e227a62cd7c9a04f68405a00244
-
C:\Windows\SysWOW64\iklworckwlyhi.exeFilesize
255KB
MD5a8ff4ba81c0fa20af1c834d0283c242a
SHA1b55144db64a8a4fcdbd59acfa202994aaced35a8
SHA2567bc392cc57238c9c14166d5319b8df403a7857c607e5ee3ced6ba2abce49a8e9
SHA5127f31b3355a7ea30d9d24b7ce533c07ef45b27fefcbeb4b21f6a88e3be9524c6bdf4193196ba83934e8d738991c35cde6df0489fb143db8fc372ad1a16f5d29b3
-
C:\Windows\SysWOW64\iklworckwlyhi.exeFilesize
255KB
MD5a8ff4ba81c0fa20af1c834d0283c242a
SHA1b55144db64a8a4fcdbd59acfa202994aaced35a8
SHA2567bc392cc57238c9c14166d5319b8df403a7857c607e5ee3ced6ba2abce49a8e9
SHA5127f31b3355a7ea30d9d24b7ce533c07ef45b27fefcbeb4b21f6a88e3be9524c6bdf4193196ba83934e8d738991c35cde6df0489fb143db8fc372ad1a16f5d29b3
-
C:\Windows\SysWOW64\iklworckwlyhi.exeFilesize
255KB
MD5a8ff4ba81c0fa20af1c834d0283c242a
SHA1b55144db64a8a4fcdbd59acfa202994aaced35a8
SHA2567bc392cc57238c9c14166d5319b8df403a7857c607e5ee3ced6ba2abce49a8e9
SHA5127f31b3355a7ea30d9d24b7ce533c07ef45b27fefcbeb4b21f6a88e3be9524c6bdf4193196ba83934e8d738991c35cde6df0489fb143db8fc372ad1a16f5d29b3
-
C:\Windows\SysWOW64\jpfhaiie.exeFilesize
255KB
MD52e0581c2ee1d214eef5a9260807db084
SHA1d3be1a084347fdf1aadb9e06357d6b9874c49915
SHA25683922009ed1bc1f38c83138bf32674b306805143aa9ebd4f4784035ae7f0e6cb
SHA5123a1c033f7ab098a1347f8cb8a84cdbec965eb96cd9039ecf2ec8e2a93ff079f0c3587118c4e68f0bfb0edd865e38c3a3f1cdda4c387b6b04d9a288e6bcdb68ba
-
C:\Windows\SysWOW64\jpfhaiie.exeFilesize
255KB
MD52e0581c2ee1d214eef5a9260807db084
SHA1d3be1a084347fdf1aadb9e06357d6b9874c49915
SHA25683922009ed1bc1f38c83138bf32674b306805143aa9ebd4f4784035ae7f0e6cb
SHA5123a1c033f7ab098a1347f8cb8a84cdbec965eb96cd9039ecf2ec8e2a93ff079f0c3587118c4e68f0bfb0edd865e38c3a3f1cdda4c387b6b04d9a288e6bcdb68ba
-
C:\Windows\SysWOW64\jpfhaiie.exeFilesize
255KB
MD52e0581c2ee1d214eef5a9260807db084
SHA1d3be1a084347fdf1aadb9e06357d6b9874c49915
SHA25683922009ed1bc1f38c83138bf32674b306805143aa9ebd4f4784035ae7f0e6cb
SHA5123a1c033f7ab098a1347f8cb8a84cdbec965eb96cd9039ecf2ec8e2a93ff079f0c3587118c4e68f0bfb0edd865e38c3a3f1cdda4c387b6b04d9a288e6bcdb68ba
-
C:\Windows\SysWOW64\vlrwkbnpwp.exeFilesize
255KB
MD53f146acf3d54dbfb41705adff0589ce8
SHA111dedae827beecf107e57df49322db19aa118429
SHA256b170288f193047d995e34d8eb66fe74bc06606b53fb8bfd47d78bf2329dced0a
SHA512fa7a456d78422848f5aabd4b3a4cfff615a9e3f813936d570499398c0ec133adaa89a53c62e735603e077657edab40decf63d8ae8463d10f7d4ab1e516954d2f
-
C:\Windows\SysWOW64\vlrwkbnpwp.exeFilesize
255KB
MD53f146acf3d54dbfb41705adff0589ce8
SHA111dedae827beecf107e57df49322db19aa118429
SHA256b170288f193047d995e34d8eb66fe74bc06606b53fb8bfd47d78bf2329dced0a
SHA512fa7a456d78422848f5aabd4b3a4cfff615a9e3f813936d570499398c0ec133adaa89a53c62e735603e077657edab40decf63d8ae8463d10f7d4ab1e516954d2f
-
C:\Windows\SysWOW64\wyvypxdzedztjdx.exeFilesize
255KB
MD56476f7606487e21a7adf40d10faa4b98
SHA1a11a6ab17fc2f9484b594c0adebefe6211f4a432
SHA256b8d7b173b9cab5245601e76b060d6803ae809ba1feb5776d89800610d668b7ce
SHA512e047e802cc0fe1f5abce85ee236dc9aaf180ec3135bb285f9ad23f8cad1eb5e63044109bd22631297038e271ddb723a758b699b488defe3e4828091370a4a81b
-
C:\Windows\SysWOW64\wyvypxdzedztjdx.exeFilesize
255KB
MD56476f7606487e21a7adf40d10faa4b98
SHA1a11a6ab17fc2f9484b594c0adebefe6211f4a432
SHA256b8d7b173b9cab5245601e76b060d6803ae809ba1feb5776d89800610d668b7ce
SHA512e047e802cc0fe1f5abce85ee236dc9aaf180ec3135bb285f9ad23f8cad1eb5e63044109bd22631297038e271ddb723a758b699b488defe3e4828091370a4a81b
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\Windows\SysWOW64\iklworckwlyhi.exeFilesize
255KB
MD5a8ff4ba81c0fa20af1c834d0283c242a
SHA1b55144db64a8a4fcdbd59acfa202994aaced35a8
SHA2567bc392cc57238c9c14166d5319b8df403a7857c607e5ee3ced6ba2abce49a8e9
SHA5127f31b3355a7ea30d9d24b7ce533c07ef45b27fefcbeb4b21f6a88e3be9524c6bdf4193196ba83934e8d738991c35cde6df0489fb143db8fc372ad1a16f5d29b3
-
\Windows\SysWOW64\iklworckwlyhi.exeFilesize
255KB
MD5a8ff4ba81c0fa20af1c834d0283c242a
SHA1b55144db64a8a4fcdbd59acfa202994aaced35a8
SHA2567bc392cc57238c9c14166d5319b8df403a7857c607e5ee3ced6ba2abce49a8e9
SHA5127f31b3355a7ea30d9d24b7ce533c07ef45b27fefcbeb4b21f6a88e3be9524c6bdf4193196ba83934e8d738991c35cde6df0489fb143db8fc372ad1a16f5d29b3
-
\Windows\SysWOW64\jpfhaiie.exeFilesize
255KB
MD52e0581c2ee1d214eef5a9260807db084
SHA1d3be1a084347fdf1aadb9e06357d6b9874c49915
SHA25683922009ed1bc1f38c83138bf32674b306805143aa9ebd4f4784035ae7f0e6cb
SHA5123a1c033f7ab098a1347f8cb8a84cdbec965eb96cd9039ecf2ec8e2a93ff079f0c3587118c4e68f0bfb0edd865e38c3a3f1cdda4c387b6b04d9a288e6bcdb68ba
-
\Windows\SysWOW64\jpfhaiie.exeFilesize
255KB
MD52e0581c2ee1d214eef5a9260807db084
SHA1d3be1a084347fdf1aadb9e06357d6b9874c49915
SHA25683922009ed1bc1f38c83138bf32674b306805143aa9ebd4f4784035ae7f0e6cb
SHA5123a1c033f7ab098a1347f8cb8a84cdbec965eb96cd9039ecf2ec8e2a93ff079f0c3587118c4e68f0bfb0edd865e38c3a3f1cdda4c387b6b04d9a288e6bcdb68ba
-
\Windows\SysWOW64\vlrwkbnpwp.exeFilesize
255KB
MD53f146acf3d54dbfb41705adff0589ce8
SHA111dedae827beecf107e57df49322db19aa118429
SHA256b170288f193047d995e34d8eb66fe74bc06606b53fb8bfd47d78bf2329dced0a
SHA512fa7a456d78422848f5aabd4b3a4cfff615a9e3f813936d570499398c0ec133adaa89a53c62e735603e077657edab40decf63d8ae8463d10f7d4ab1e516954d2f
-
\Windows\SysWOW64\wyvypxdzedztjdx.exeFilesize
255KB
MD56476f7606487e21a7adf40d10faa4b98
SHA1a11a6ab17fc2f9484b594c0adebefe6211f4a432
SHA256b8d7b173b9cab5245601e76b060d6803ae809ba1feb5776d89800610d668b7ce
SHA512e047e802cc0fe1f5abce85ee236dc9aaf180ec3135bb285f9ad23f8cad1eb5e63044109bd22631297038e271ddb723a758b699b488defe3e4828091370a4a81b
-
memory/468-79-0x0000000000000000-mapping.dmp
-
memory/468-105-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/468-94-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/660-95-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/660-83-0x0000000000000000-mapping.dmp
-
memory/660-107-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1064-100-0x000000007141D000-0x0000000071428000-memory.dmpFilesize
44KB
-
memory/1064-96-0x0000000070431000-0x0000000070433000-memory.dmpFilesize
8KB
-
memory/1064-89-0x00000000729B1000-0x00000000729B4000-memory.dmpFilesize
12KB
-
memory/1064-115-0x000000007141D000-0x0000000071428000-memory.dmpFilesize
44KB
-
memory/1064-114-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1064-108-0x000000007141D000-0x0000000071428000-memory.dmpFilesize
44KB
-
memory/1064-97-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1064-87-0x0000000000000000-mapping.dmp
-
memory/1080-57-0x0000000002FE0000-0x0000000003080000-memory.dmpFilesize
640KB
-
memory/1080-56-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1080-54-0x00000000758C1000-0x00000000758C3000-memory.dmpFilesize
8KB
-
memory/1080-88-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1520-92-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1520-103-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1520-68-0x0000000000000000-mapping.dmp
-
memory/1584-110-0x000007FEFBE11000-0x000007FEFBE13000-memory.dmpFilesize
8KB
-
memory/1584-109-0x0000000000000000-mapping.dmp
-
memory/1724-93-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1724-72-0x0000000000000000-mapping.dmp
-
memory/1724-104-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1744-62-0x0000000000000000-mapping.dmp
-
memory/1744-102-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1744-91-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1832-77-0x0000000000000000-mapping.dmp
-
memory/2028-106-0x0000000003460000-0x0000000003500000-memory.dmpFilesize
640KB
-
memory/2028-58-0x0000000000000000-mapping.dmp
-
memory/2028-101-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2028-90-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB