Analysis
-
max time kernel
153s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:02
Behavioral task
behavioral1
Sample
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe
Resource
win10v2004-20221111-en
General
-
Target
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe
-
Size
255KB
-
MD5
9dbc8b2c05f2cd8d5519bbac6cbcc1a0
-
SHA1
cab0e73fe8e6ef0caadd7fc7aeb781dae163ed19
-
SHA256
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce
-
SHA512
6062f9086cc50b4c1ca7c8166ca6134ccefaf3ce509d99826eb32166c86626d93088a7c4a1711826e0171fa869baf8dc50326be3bc3aeec0827bec854d5fd309
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJa:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
ecrqacizxl.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ecrqacizxl.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
ecrqacizxl.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ecrqacizxl.exe -
Processes:
ecrqacizxl.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ecrqacizxl.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ecrqacizxl.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ecrqacizxl.exe -
Executes dropped EXE 5 IoCs
Processes:
ecrqacizxl.exefyitkndetalbzzk.exeelslctjg.exemevdmqbppkqxe.exeelslctjg.exepid process 1628 ecrqacizxl.exe 1712 fyitkndetalbzzk.exe 1584 elslctjg.exe 1800 mevdmqbppkqxe.exe 1164 elslctjg.exe -
Processes:
resource yara_rule behavioral1/memory/1992-55-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\ecrqacizxl.exe upx C:\Windows\SysWOW64\ecrqacizxl.exe upx \Windows\SysWOW64\fyitkndetalbzzk.exe upx C:\Windows\SysWOW64\fyitkndetalbzzk.exe upx C:\Windows\SysWOW64\ecrqacizxl.exe upx \Windows\SysWOW64\elslctjg.exe upx C:\Windows\SysWOW64\elslctjg.exe upx C:\Windows\SysWOW64\fyitkndetalbzzk.exe upx \Windows\SysWOW64\mevdmqbppkqxe.exe upx C:\Windows\SysWOW64\mevdmqbppkqxe.exe upx C:\Windows\SysWOW64\elslctjg.exe upx C:\Windows\SysWOW64\mevdmqbppkqxe.exe upx \Windows\SysWOW64\elslctjg.exe upx C:\Windows\SysWOW64\elslctjg.exe upx behavioral1/memory/1992-81-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1628-83-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1712-84-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1584-85-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1800-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1164-87-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1628-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1712-89-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1584-90-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1800-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1164-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe upx C:\Users\Admin\Documents\DismountOpen.doc.exe upx -
Loads dropped DLL 5 IoCs
Processes:
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exeecrqacizxl.exepid process 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1628 ecrqacizxl.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
ecrqacizxl.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" ecrqacizxl.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
fyitkndetalbzzk.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run fyitkndetalbzzk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vubeaqfb = "ecrqacizxl.exe" fyitkndetalbzzk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xwflekgs = "fyitkndetalbzzk.exe" fyitkndetalbzzk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mevdmqbppkqxe.exe" fyitkndetalbzzk.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
elslctjg.exeecrqacizxl.exeelslctjg.exedescription ioc process File opened (read-only) \??\q: elslctjg.exe File opened (read-only) \??\v: elslctjg.exe File opened (read-only) \??\q: ecrqacizxl.exe File opened (read-only) \??\i: elslctjg.exe File opened (read-only) \??\f: elslctjg.exe File opened (read-only) \??\i: elslctjg.exe File opened (read-only) \??\m: elslctjg.exe File opened (read-only) \??\j: ecrqacizxl.exe File opened (read-only) \??\b: elslctjg.exe File opened (read-only) \??\e: elslctjg.exe File opened (read-only) \??\y: elslctjg.exe File opened (read-only) \??\o: elslctjg.exe File opened (read-only) \??\a: ecrqacizxl.exe File opened (read-only) \??\f: ecrqacizxl.exe File opened (read-only) \??\k: ecrqacizxl.exe File opened (read-only) \??\x: elslctjg.exe File opened (read-only) \??\k: elslctjg.exe File opened (read-only) \??\r: ecrqacizxl.exe File opened (read-only) \??\s: ecrqacizxl.exe File opened (read-only) \??\r: elslctjg.exe File opened (read-only) \??\p: elslctjg.exe File opened (read-only) \??\b: ecrqacizxl.exe File opened (read-only) \??\t: ecrqacizxl.exe File opened (read-only) \??\u: ecrqacizxl.exe File opened (read-only) \??\j: elslctjg.exe File opened (read-only) \??\a: elslctjg.exe File opened (read-only) \??\n: elslctjg.exe File opened (read-only) \??\t: elslctjg.exe File opened (read-only) \??\y: elslctjg.exe File opened (read-only) \??\l: ecrqacizxl.exe File opened (read-only) \??\o: ecrqacizxl.exe File opened (read-only) \??\l: elslctjg.exe File opened (read-only) \??\p: elslctjg.exe File opened (read-only) \??\h: ecrqacizxl.exe File opened (read-only) \??\i: ecrqacizxl.exe File opened (read-only) \??\s: elslctjg.exe File opened (read-only) \??\j: elslctjg.exe File opened (read-only) \??\w: elslctjg.exe File opened (read-only) \??\x: elslctjg.exe File opened (read-only) \??\y: ecrqacizxl.exe File opened (read-only) \??\r: elslctjg.exe File opened (read-only) \??\p: ecrqacizxl.exe File opened (read-only) \??\t: elslctjg.exe File opened (read-only) \??\v: ecrqacizxl.exe File opened (read-only) \??\f: elslctjg.exe File opened (read-only) \??\g: elslctjg.exe File opened (read-only) \??\o: elslctjg.exe File opened (read-only) \??\b: elslctjg.exe File opened (read-only) \??\e: elslctjg.exe File opened (read-only) \??\l: elslctjg.exe File opened (read-only) \??\e: ecrqacizxl.exe File opened (read-only) \??\m: ecrqacizxl.exe File opened (read-only) \??\n: ecrqacizxl.exe File opened (read-only) \??\z: ecrqacizxl.exe File opened (read-only) \??\h: elslctjg.exe File opened (read-only) \??\m: elslctjg.exe File opened (read-only) \??\z: elslctjg.exe File opened (read-only) \??\k: elslctjg.exe File opened (read-only) \??\n: elslctjg.exe File opened (read-only) \??\v: elslctjg.exe File opened (read-only) \??\w: elslctjg.exe File opened (read-only) \??\g: elslctjg.exe File opened (read-only) \??\h: elslctjg.exe File opened (read-only) \??\u: elslctjg.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
ecrqacizxl.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ecrqacizxl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ecrqacizxl.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1992-55-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1992-81-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1628-83-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1712-84-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1584-85-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1800-86-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1164-87-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1628-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1712-89-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1584-90-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1800-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1164-93-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exeecrqacizxl.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ecrqacizxl.exe 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe File created C:\Windows\SysWOW64\fyitkndetalbzzk.exe 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe File opened for modification C:\Windows\SysWOW64\fyitkndetalbzzk.exe 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe File created C:\Windows\SysWOW64\mevdmqbppkqxe.exe 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe File opened for modification C:\Windows\SysWOW64\mevdmqbppkqxe.exe 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe File created C:\Windows\SysWOW64\ecrqacizxl.exe 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe File created C:\Windows\SysWOW64\elslctjg.exe 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe File opened for modification C:\Windows\SysWOW64\elslctjg.exe 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ecrqacizxl.exe -
Drops file in Program Files directory 14 IoCs
Processes:
elslctjg.exeelslctjg.exedescription ioc process File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe elslctjg.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal elslctjg.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe elslctjg.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe elslctjg.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe elslctjg.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal elslctjg.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe elslctjg.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe elslctjg.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe elslctjg.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal elslctjg.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe elslctjg.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal elslctjg.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe elslctjg.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe elslctjg.exe -
Drops file in Windows directory 5 IoCs
Processes:
WINWORD.EXE909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exedescription ioc process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEecrqacizxl.exe909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ecrqacizxl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ecrqacizxl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ecrqacizxl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ecrqacizxl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ecrqacizxl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFF824F26856E9135D65F7D97BC94E632593566466236D791" 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ecrqacizxl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 340 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exeecrqacizxl.exefyitkndetalbzzk.exeelslctjg.exemevdmqbppkqxe.exeelslctjg.exepid process 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1628 ecrqacizxl.exe 1628 ecrqacizxl.exe 1628 ecrqacizxl.exe 1628 ecrqacizxl.exe 1628 ecrqacizxl.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1584 elslctjg.exe 1584 elslctjg.exe 1584 elslctjg.exe 1584 elslctjg.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1164 elslctjg.exe 1164 elslctjg.exe 1164 elslctjg.exe 1164 elslctjg.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1712 fyitkndetalbzzk.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exeecrqacizxl.exefyitkndetalbzzk.exeelslctjg.exemevdmqbppkqxe.exeelslctjg.exepid process 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1628 ecrqacizxl.exe 1628 ecrqacizxl.exe 1628 ecrqacizxl.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1584 elslctjg.exe 1584 elslctjg.exe 1584 elslctjg.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1164 elslctjg.exe 1164 elslctjg.exe 1164 elslctjg.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exeecrqacizxl.exefyitkndetalbzzk.exeelslctjg.exemevdmqbppkqxe.exeelslctjg.exepid process 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe 1628 ecrqacizxl.exe 1628 ecrqacizxl.exe 1628 ecrqacizxl.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1712 fyitkndetalbzzk.exe 1584 elslctjg.exe 1584 elslctjg.exe 1584 elslctjg.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1800 mevdmqbppkqxe.exe 1164 elslctjg.exe 1164 elslctjg.exe 1164 elslctjg.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 340 WINWORD.EXE 340 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exeecrqacizxl.exeWINWORD.EXEdescription pid process target process PID 1992 wrote to memory of 1628 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe ecrqacizxl.exe PID 1992 wrote to memory of 1628 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe ecrqacizxl.exe PID 1992 wrote to memory of 1628 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe ecrqacizxl.exe PID 1992 wrote to memory of 1628 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe ecrqacizxl.exe PID 1992 wrote to memory of 1712 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe fyitkndetalbzzk.exe PID 1992 wrote to memory of 1712 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe fyitkndetalbzzk.exe PID 1992 wrote to memory of 1712 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe fyitkndetalbzzk.exe PID 1992 wrote to memory of 1712 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe fyitkndetalbzzk.exe PID 1992 wrote to memory of 1584 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe elslctjg.exe PID 1992 wrote to memory of 1584 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe elslctjg.exe PID 1992 wrote to memory of 1584 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe elslctjg.exe PID 1992 wrote to memory of 1584 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe elslctjg.exe PID 1992 wrote to memory of 1800 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe mevdmqbppkqxe.exe PID 1992 wrote to memory of 1800 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe mevdmqbppkqxe.exe PID 1992 wrote to memory of 1800 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe mevdmqbppkqxe.exe PID 1992 wrote to memory of 1800 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe mevdmqbppkqxe.exe PID 1628 wrote to memory of 1164 1628 ecrqacizxl.exe elslctjg.exe PID 1628 wrote to memory of 1164 1628 ecrqacizxl.exe elslctjg.exe PID 1628 wrote to memory of 1164 1628 ecrqacizxl.exe elslctjg.exe PID 1628 wrote to memory of 1164 1628 ecrqacizxl.exe elslctjg.exe PID 1992 wrote to memory of 340 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe WINWORD.EXE PID 1992 wrote to memory of 340 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe WINWORD.EXE PID 1992 wrote to memory of 340 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe WINWORD.EXE PID 1992 wrote to memory of 340 1992 909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe WINWORD.EXE PID 340 wrote to memory of 1636 340 WINWORD.EXE splwow64.exe PID 340 wrote to memory of 1636 340 WINWORD.EXE splwow64.exe PID 340 wrote to memory of 1636 340 WINWORD.EXE splwow64.exe PID 340 wrote to memory of 1636 340 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe"C:\Users\Admin\AppData\Local\Temp\909d25855a6b546bd5bdd737923153e7ba7200c4028c22c44f29c3e1fc9bfbce.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ecrqacizxl.exeecrqacizxl.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\elslctjg.exeC:\Windows\system32\elslctjg.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\fyitkndetalbzzk.exefyitkndetalbzzk.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\elslctjg.exeelslctjg.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\mevdmqbppkqxe.exemevdmqbppkqxe.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
7Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exeFilesize
255KB
MD585f633df305432ede3047fffa11283a9
SHA1da8c6b8c542b5d1ec9e9d2e87407c90a4c20231d
SHA25690850632f252e43663a8cffb09ed97290e6442ad40fe443c22cd2d9210ee7165
SHA51218c07c5e26a7b95a2b253eba7bbafff84a9b24e480585808ff247bce58d3f518576613c187c537c1342b8b180ed82446098c8fae5006aeb9e865e31596294929
-
C:\Users\Admin\Documents\DismountOpen.doc.exeFilesize
255KB
MD54eb7973556a5444b90a285e772bfd41c
SHA1284460a136b10f729d3a1cfb6b2236440a4bcfea
SHA25649de05ba92509e8dc4f5ecfefc7bb3e9dd6f15db7cd17d3ce44270bc19a5b0ba
SHA5125e1b10c8b5a6e0d701806862f8e1e4d376c15341e4017573aab0fd4cba7a75f1793ad8100d91d4b2748a087ffc57e0771ecc6f39ba4fbf3d2b706bd046b62716
-
C:\Windows\SysWOW64\ecrqacizxl.exeFilesize
255KB
MD54e43355e11924f15cb04ea4f27fa20ea
SHA12a04fc347e77924f44825d647408a50911ce6317
SHA256efa1f7cd5fe74464f691efef67cca8199e37b5961c0c4e754709f5ace87ae8dc
SHA512b4fb39eff7313fcfecfe71859e8cfcf1c23f6f628c4951a36e78c8c3e5ea512cda79967d0e1230db2fd63a622c21946a9dac3efc21017223176f5b7f2a4f1d16
-
C:\Windows\SysWOW64\ecrqacizxl.exeFilesize
255KB
MD54e43355e11924f15cb04ea4f27fa20ea
SHA12a04fc347e77924f44825d647408a50911ce6317
SHA256efa1f7cd5fe74464f691efef67cca8199e37b5961c0c4e754709f5ace87ae8dc
SHA512b4fb39eff7313fcfecfe71859e8cfcf1c23f6f628c4951a36e78c8c3e5ea512cda79967d0e1230db2fd63a622c21946a9dac3efc21017223176f5b7f2a4f1d16
-
C:\Windows\SysWOW64\elslctjg.exeFilesize
255KB
MD56d372381e2f39f2175d4e62622e4f6b4
SHA12fe7f86dabf5fde85ab54fe978bcd1b69a9e6f41
SHA2561c0fbbf2d043337008b415151d34239cfc723811e11c86db60bb92ecdb7ec317
SHA512263969efd2d60ebf5d4de9c313f7b46700e79c9bb170ab23426548c09b31ff443295175792065686ed5365724a148c288d1d48e0d40353f9b949693a633376ba
-
C:\Windows\SysWOW64\elslctjg.exeFilesize
255KB
MD56d372381e2f39f2175d4e62622e4f6b4
SHA12fe7f86dabf5fde85ab54fe978bcd1b69a9e6f41
SHA2561c0fbbf2d043337008b415151d34239cfc723811e11c86db60bb92ecdb7ec317
SHA512263969efd2d60ebf5d4de9c313f7b46700e79c9bb170ab23426548c09b31ff443295175792065686ed5365724a148c288d1d48e0d40353f9b949693a633376ba
-
C:\Windows\SysWOW64\elslctjg.exeFilesize
255KB
MD56d372381e2f39f2175d4e62622e4f6b4
SHA12fe7f86dabf5fde85ab54fe978bcd1b69a9e6f41
SHA2561c0fbbf2d043337008b415151d34239cfc723811e11c86db60bb92ecdb7ec317
SHA512263969efd2d60ebf5d4de9c313f7b46700e79c9bb170ab23426548c09b31ff443295175792065686ed5365724a148c288d1d48e0d40353f9b949693a633376ba
-
C:\Windows\SysWOW64\fyitkndetalbzzk.exeFilesize
255KB
MD57b28c2c9034ef3fa2146516e9748b08f
SHA10799ffea281d7ae792af2828255abe1e00a355f3
SHA25692814a854350039ed958654e32dbac829018e4679a971e019d74f7a182a0086d
SHA512e0686d3fbd53daf2c30b69aae56fd095b868c0577c7d68a129310e6bc3cc265391005accfdb3aa52e786d7d416278c73c8ec222b3b5d96f19c4f9c1523e1a608
-
C:\Windows\SysWOW64\fyitkndetalbzzk.exeFilesize
255KB
MD57b28c2c9034ef3fa2146516e9748b08f
SHA10799ffea281d7ae792af2828255abe1e00a355f3
SHA25692814a854350039ed958654e32dbac829018e4679a971e019d74f7a182a0086d
SHA512e0686d3fbd53daf2c30b69aae56fd095b868c0577c7d68a129310e6bc3cc265391005accfdb3aa52e786d7d416278c73c8ec222b3b5d96f19c4f9c1523e1a608
-
C:\Windows\SysWOW64\mevdmqbppkqxe.exeFilesize
255KB
MD5b6bec3b61714aea77557053d6a21af3a
SHA13eae93247ded315e24ed12a62beab0daa7337e84
SHA25661a03ca10221a189beb8ee54eb7671b7904ba610db348eb5841d345966bebf34
SHA512cd88a2982e09f59eb6f90e245bc7509139295cb303b9911848a24840674effe9b00e66895dcec83fadab246a20bdfcbf250d354a1e5bccf5c0aad895243f6f7f
-
C:\Windows\SysWOW64\mevdmqbppkqxe.exeFilesize
255KB
MD5b6bec3b61714aea77557053d6a21af3a
SHA13eae93247ded315e24ed12a62beab0daa7337e84
SHA25661a03ca10221a189beb8ee54eb7671b7904ba610db348eb5841d345966bebf34
SHA512cd88a2982e09f59eb6f90e245bc7509139295cb303b9911848a24840674effe9b00e66895dcec83fadab246a20bdfcbf250d354a1e5bccf5c0aad895243f6f7f
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\Windows\SysWOW64\ecrqacizxl.exeFilesize
255KB
MD54e43355e11924f15cb04ea4f27fa20ea
SHA12a04fc347e77924f44825d647408a50911ce6317
SHA256efa1f7cd5fe74464f691efef67cca8199e37b5961c0c4e754709f5ace87ae8dc
SHA512b4fb39eff7313fcfecfe71859e8cfcf1c23f6f628c4951a36e78c8c3e5ea512cda79967d0e1230db2fd63a622c21946a9dac3efc21017223176f5b7f2a4f1d16
-
\Windows\SysWOW64\elslctjg.exeFilesize
255KB
MD56d372381e2f39f2175d4e62622e4f6b4
SHA12fe7f86dabf5fde85ab54fe978bcd1b69a9e6f41
SHA2561c0fbbf2d043337008b415151d34239cfc723811e11c86db60bb92ecdb7ec317
SHA512263969efd2d60ebf5d4de9c313f7b46700e79c9bb170ab23426548c09b31ff443295175792065686ed5365724a148c288d1d48e0d40353f9b949693a633376ba
-
\Windows\SysWOW64\elslctjg.exeFilesize
255KB
MD56d372381e2f39f2175d4e62622e4f6b4
SHA12fe7f86dabf5fde85ab54fe978bcd1b69a9e6f41
SHA2561c0fbbf2d043337008b415151d34239cfc723811e11c86db60bb92ecdb7ec317
SHA512263969efd2d60ebf5d4de9c313f7b46700e79c9bb170ab23426548c09b31ff443295175792065686ed5365724a148c288d1d48e0d40353f9b949693a633376ba
-
\Windows\SysWOW64\fyitkndetalbzzk.exeFilesize
255KB
MD57b28c2c9034ef3fa2146516e9748b08f
SHA10799ffea281d7ae792af2828255abe1e00a355f3
SHA25692814a854350039ed958654e32dbac829018e4679a971e019d74f7a182a0086d
SHA512e0686d3fbd53daf2c30b69aae56fd095b868c0577c7d68a129310e6bc3cc265391005accfdb3aa52e786d7d416278c73c8ec222b3b5d96f19c4f9c1523e1a608
-
\Windows\SysWOW64\mevdmqbppkqxe.exeFilesize
255KB
MD5b6bec3b61714aea77557053d6a21af3a
SHA13eae93247ded315e24ed12a62beab0daa7337e84
SHA25661a03ca10221a189beb8ee54eb7671b7904ba610db348eb5841d345966bebf34
SHA512cd88a2982e09f59eb6f90e245bc7509139295cb303b9911848a24840674effe9b00e66895dcec83fadab246a20bdfcbf250d354a1e5bccf5c0aad895243f6f7f
-
memory/340-95-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/340-104-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/340-80-0x0000000000000000-mapping.dmp
-
memory/340-98-0x0000000070EAD000-0x0000000070EB8000-memory.dmpFilesize
44KB
-
memory/340-82-0x0000000072441000-0x0000000072444000-memory.dmpFilesize
12KB
-
memory/340-103-0x0000000070EAD000-0x0000000070EB8000-memory.dmpFilesize
44KB
-
memory/340-94-0x000000006FEC1000-0x000000006FEC3000-memory.dmpFilesize
8KB
-
memory/1164-77-0x0000000000000000-mapping.dmp
-
memory/1164-87-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1164-93-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1584-66-0x0000000000000000-mapping.dmp
-
memory/1584-90-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1584-85-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1628-92-0x0000000003C90000-0x0000000003D30000-memory.dmpFilesize
640KB
-
memory/1628-83-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1628-57-0x0000000000000000-mapping.dmp
-
memory/1628-88-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1636-101-0x0000000000000000-mapping.dmp
-
memory/1636-102-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmpFilesize
8KB
-
memory/1712-84-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1712-89-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1712-61-0x0000000000000000-mapping.dmp
-
memory/1800-86-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1800-71-0x0000000000000000-mapping.dmp
-
memory/1800-91-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1992-54-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/1992-81-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1992-55-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB