7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6

Analysis

max time kernel
188s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
Size

255KB
MD5

91fdc5866a1a2beb0c0264724e95c533
SHA1

de7c57622c61abe3fdc8c0b60e974fe469f08627
SHA256

7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6
SHA512

9697b99751f23c6f0f2aa73125a78fd99d4e5c2b9a63a392378fd11aafb1c529edfebd3d00172af30453f3b8085f5b4ad81e2cfe3de1cfee44fd6d91b02b83d4
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIo

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

vvvzjnnhlz.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	vvvzjnnhlz.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

vvvzjnnhlz.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vvvzjnnhlz.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

vvvzjnnhlz.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	vvvzjnnhlz.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

vvvzjnnhlz.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vvvzjnnhlz.exe

Executes dropped EXE 5 IoCs

Processes:

vvvzjnnhlz.exeakvoglnialxnwfp.exerypijqzo.exezlbnrdgrojqno.exerypijqzo.exe

pid process

556 vvvzjnnhlz.exe
652 akvoglnialxnwfp.exe
520 rypijqzo.exe
1248 zlbnrdgrojqno.exe
616 rypijqzo.exe

pid	process
556	vvvzjnnhlz.exe
652	akvoglnialxnwfp.exe
520	rypijqzo.exe
1248	zlbnrdgrojqno.exe
616	rypijqzo.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1740-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\vvvzjnnhlz.exe	upx
C:\Windows\SysWOW64\vvvzjnnhlz.exe	upx
C:\Windows\SysWOW64\akvoglnialxnwfp.exe	upx
C:\Windows\SysWOW64\vvvzjnnhlz.exe	upx
\Windows\SysWOW64\rypijqzo.exe	upx
C:\Windows\SysWOW64\rypijqzo.exe	upx
\Windows\SysWOW64\zlbnrdgrojqno.exe	upx
\Windows\SysWOW64\akvoglnialxnwfp.exe	upx
C:\Windows\SysWOW64\rypijqzo.exe	upx
C:\Windows\SysWOW64\zlbnrdgrojqno.exe	upx
C:\Windows\SysWOW64\akvoglnialxnwfp.exe	upx
C:\Windows\SysWOW64\zlbnrdgrojqno.exe	upx
\Windows\SysWOW64\rypijqzo.exe	upx
C:\Windows\SysWOW64\rypijqzo.exe	upx
behavioral1/memory/1740-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/556-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/652-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/520-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1248-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/616-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	upx
behavioral1/memory/556-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/616-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1248-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/520-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/652-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 5 IoCs

Processes:

7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exevvvzjnnhlz.exe

pid	process
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
556	vvvzjnnhlz.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

vvvzjnnhlz.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	vvvzjnnhlz.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

akvoglnialxnwfp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\btmuupse = "vvvzjnnhlz.exe"	akvoglnialxnwfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\psbaxmlv = "akvoglnialxnwfp.exe"	akvoglnialxnwfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "zlbnrdgrojqno.exe"	akvoglnialxnwfp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	akvoglnialxnwfp.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vvvzjnnhlz.exerypijqzo.exerypijqzo.exe

description	ioc	process
File opened (read-only)	\??\f:	vvvzjnnhlz.exe
File opened (read-only)	\??\q:	vvvzjnnhlz.exe
File opened (read-only)	\??\b:	rypijqzo.exe
File opened (read-only)	\??\m:	vvvzjnnhlz.exe
File opened (read-only)	\??\y:	vvvzjnnhlz.exe
File opened (read-only)	\??\z:	vvvzjnnhlz.exe
File opened (read-only)	\??\e:	rypijqzo.exe
File opened (read-only)	\??\j:	rypijqzo.exe
File opened (read-only)	\??\h:	vvvzjnnhlz.exe
File opened (read-only)	\??\a:	rypijqzo.exe
File opened (read-only)	\??\z:	rypijqzo.exe
File opened (read-only)	\??\t:	vvvzjnnhlz.exe
File opened (read-only)	\??\x:	vvvzjnnhlz.exe
File opened (read-only)	\??\v:	rypijqzo.exe
File opened (read-only)	\??\g:	vvvzjnnhlz.exe
File opened (read-only)	\??\i:	rypijqzo.exe
File opened (read-only)	\??\l:	rypijqzo.exe
File opened (read-only)	\??\u:	rypijqzo.exe
File opened (read-only)	\??\b:	vvvzjnnhlz.exe
File opened (read-only)	\??\a:	rypijqzo.exe
File opened (read-only)	\??\g:	rypijqzo.exe
File opened (read-only)	\??\s:	rypijqzo.exe
File opened (read-only)	\??\z:	rypijqzo.exe
File opened (read-only)	\??\y:	rypijqzo.exe
File opened (read-only)	\??\k:	vvvzjnnhlz.exe
File opened (read-only)	\??\u:	vvvzjnnhlz.exe
File opened (read-only)	\??\j:	rypijqzo.exe
File opened (read-only)	\??\m:	rypijqzo.exe
File opened (read-only)	\??\p:	rypijqzo.exe
File opened (read-only)	\??\n:	vvvzjnnhlz.exe
File opened (read-only)	\??\w:	vvvzjnnhlz.exe
File opened (read-only)	\??\y:	rypijqzo.exe
File opened (read-only)	\??\h:	rypijqzo.exe
File opened (read-only)	\??\h:	rypijqzo.exe
File opened (read-only)	\??\o:	rypijqzo.exe
File opened (read-only)	\??\e:	vvvzjnnhlz.exe
File opened (read-only)	\??\l:	vvvzjnnhlz.exe
File opened (read-only)	\??\p:	vvvzjnnhlz.exe
File opened (read-only)	\??\s:	vvvzjnnhlz.exe
File opened (read-only)	\??\v:	vvvzjnnhlz.exe
File opened (read-only)	\??\n:	rypijqzo.exe
File opened (read-only)	\??\v:	rypijqzo.exe
File opened (read-only)	\??\w:	rypijqzo.exe
File opened (read-only)	\??\o:	vvvzjnnhlz.exe
File opened (read-only)	\??\r:	vvvzjnnhlz.exe
File opened (read-only)	\??\m:	rypijqzo.exe
File opened (read-only)	\??\x:	rypijqzo.exe
File opened (read-only)	\??\n:	rypijqzo.exe
File opened (read-only)	\??\r:	rypijqzo.exe
File opened (read-only)	\??\u:	rypijqzo.exe
File opened (read-only)	\??\x:	rypijqzo.exe
File opened (read-only)	\??\k:	rypijqzo.exe
File opened (read-only)	\??\o:	rypijqzo.exe
File opened (read-only)	\??\e:	rypijqzo.exe
File opened (read-only)	\??\f:	rypijqzo.exe
File opened (read-only)	\??\l:	rypijqzo.exe
File opened (read-only)	\??\f:	rypijqzo.exe
File opened (read-only)	\??\r:	rypijqzo.exe
File opened (read-only)	\??\t:	rypijqzo.exe
File opened (read-only)	\??\i:	rypijqzo.exe
File opened (read-only)	\??\k:	rypijqzo.exe
File opened (read-only)	\??\t:	rypijqzo.exe
File opened (read-only)	\??\i:	vvvzjnnhlz.exe
File opened (read-only)	\??\g:	rypijqzo.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

vvvzjnnhlz.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	vvvzjnnhlz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	vvvzjnnhlz.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1740-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1740-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/556-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/652-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/520-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1248-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/616-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/556-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/616-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1248-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/520-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/652-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exevvvzjnnhlz.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rypijqzo.exe	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
File created	C:\Windows\SysWOW64\zlbnrdgrojqno.exe	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	vvvzjnnhlz.exe
File created	C:\Windows\SysWOW64\akvoglnialxnwfp.exe	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
File opened for modification	C:\Windows\SysWOW64\akvoglnialxnwfp.exe	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
File opened for modification	C:\Windows\SysWOW64\rypijqzo.exe	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
File opened for modification	C:\Windows\SysWOW64\zlbnrdgrojqno.exe	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
File created	C:\Windows\SysWOW64\vvvzjnnhlz.exe	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
File opened for modification	C:\Windows\SysWOW64\vvvzjnnhlz.exe	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe

Drops file in Program Files directory 14 IoCs

Processes:

rypijqzo.exerypijqzo.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	rypijqzo.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	rypijqzo.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	rypijqzo.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	rypijqzo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	rypijqzo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	rypijqzo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	rypijqzo.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	rypijqzo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	rypijqzo.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	rypijqzo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	rypijqzo.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	rypijqzo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	rypijqzo.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	rypijqzo.exe

Drops file in Windows directory 5 IoCs

Processes:

7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEvvvzjnnhlz.exe7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	vvvzjnnhlz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	vvvzjnnhlz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FFBFF8B485D851F9041D7587D92BCEFE13D593666466330D79B"	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	vvvzjnnhlz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	vvvzjnnhlz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193FC70B15E0DAC5B9CC7CE9ED9237CF"	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1080 WINWORD.EXE

pid	process
1080	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exerypijqzo.exevvvzjnnhlz.exeakvoglnialxnwfp.exezlbnrdgrojqno.exerypijqzo.exe

pid	process
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
520	rypijqzo.exe
520	rypijqzo.exe
520	rypijqzo.exe
520	rypijqzo.exe
556	vvvzjnnhlz.exe
556	vvvzjnnhlz.exe
556	vvvzjnnhlz.exe
556	vvvzjnnhlz.exe
556	vvvzjnnhlz.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
616	rypijqzo.exe
616	rypijqzo.exe
616	rypijqzo.exe
616	rypijqzo.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exevvvzjnnhlz.exerypijqzo.exeakvoglnialxnwfp.exezlbnrdgrojqno.exerypijqzo.exe

pid	process
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
556	vvvzjnnhlz.exe
556	vvvzjnnhlz.exe
556	vvvzjnnhlz.exe
520	rypijqzo.exe
520	rypijqzo.exe
520	rypijqzo.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
616	rypijqzo.exe
616	rypijqzo.exe
616	rypijqzo.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exevvvzjnnhlz.exerypijqzo.exeakvoglnialxnwfp.exezlbnrdgrojqno.exerypijqzo.exe

pid	process
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
556	vvvzjnnhlz.exe
556	vvvzjnnhlz.exe
556	vvvzjnnhlz.exe
520	rypijqzo.exe
520	rypijqzo.exe
520	rypijqzo.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
652	akvoglnialxnwfp.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
1248	zlbnrdgrojqno.exe
616	rypijqzo.exe
616	rypijqzo.exe
616	rypijqzo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1080 WINWORD.EXE
1080 WINWORD.EXE

pid	process
1080	WINWORD.EXE
1080	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exevvvzjnnhlz.exeWINWORD.EXE

description	pid	process	target process
PID 1740 wrote to memory of 556	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	vvvzjnnhlz.exe
PID 1740 wrote to memory of 556	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	vvvzjnnhlz.exe
PID 1740 wrote to memory of 556	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	vvvzjnnhlz.exe
PID 1740 wrote to memory of 556	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	vvvzjnnhlz.exe
PID 1740 wrote to memory of 652	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	akvoglnialxnwfp.exe
PID 1740 wrote to memory of 652	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	akvoglnialxnwfp.exe
PID 1740 wrote to memory of 652	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	akvoglnialxnwfp.exe
PID 1740 wrote to memory of 652	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	akvoglnialxnwfp.exe
PID 1740 wrote to memory of 520	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	rypijqzo.exe
PID 1740 wrote to memory of 520	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	rypijqzo.exe
PID 1740 wrote to memory of 520	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	rypijqzo.exe
PID 1740 wrote to memory of 520	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	rypijqzo.exe
PID 1740 wrote to memory of 1248	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	zlbnrdgrojqno.exe
PID 1740 wrote to memory of 1248	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	zlbnrdgrojqno.exe
PID 1740 wrote to memory of 1248	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	zlbnrdgrojqno.exe
PID 1740 wrote to memory of 1248	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	zlbnrdgrojqno.exe
PID 556 wrote to memory of 616	556	vvvzjnnhlz.exe	rypijqzo.exe
PID 556 wrote to memory of 616	556	vvvzjnnhlz.exe	rypijqzo.exe
PID 556 wrote to memory of 616	556	vvvzjnnhlz.exe	rypijqzo.exe
PID 556 wrote to memory of 616	556	vvvzjnnhlz.exe	rypijqzo.exe
PID 1740 wrote to memory of 1080	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	WINWORD.EXE
PID 1740 wrote to memory of 1080	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	WINWORD.EXE
PID 1740 wrote to memory of 1080	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	WINWORD.EXE
PID 1740 wrote to memory of 1080	1740	7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe	WINWORD.EXE
PID 1080 wrote to memory of 1880	1080	WINWORD.EXE	splwow64.exe
PID 1080 wrote to memory of 1880	1080	WINWORD.EXE	splwow64.exe
PID 1080 wrote to memory of 1880	1080	WINWORD.EXE	splwow64.exe
PID 1080 wrote to memory of 1880	1080	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe
"C:\Users\Admin\AppData\Local\Temp\7df29a0d5e7b6e9a48c3492689a0196983d943fafde65800f0d2ac4ebba918f6.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\SysWOW64\vvvzjnnhlz.exe
vvvzjnnhlz.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:556

C:\Windows\SysWOW64\rypijqzo.exe
C:\Windows\system32\rypijqzo.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:616

C:\Windows\SysWOW64\akvoglnialxnwfp.exe
akvoglnialxnwfp.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:652

C:\Windows\SysWOW64\rypijqzo.exe
rypijqzo.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:520

C:\Windows\SysWOW64\zlbnrdgrojqno.exe
zlbnrdgrojqno.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1248

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:1880

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
Filesize
255KB

MD5
6afaba834d7984f19cd95e49dc1dc8c9

SHA1
51a77cab4ac09c37f2882d791a07206817bb77ba

SHA256
1a4ca000d3bcac3a1bb06e59e0cc38656f8915231559ab9626be4b96f17a9c29

SHA512
b03c126c733519a717c8888871ad7ffb3a7e47cc082797167e879d0f7510c20e9dd560943a0e6eee25e66ce1d05c04c8406ad4ef1b08ac720169353368a45d12

Download Submit
C:\Windows\SysWOW64\akvoglnialxnwfp.exe
Filesize
255KB

MD5
e39a6d0ded7e312a60a042dd38e66a73

SHA1
725ec5c65de40c9cff5e292961524d1a9e5558e6

SHA256
8430ef8a22a2c280b954445a2fb43cd9d50e734bbe8eac96aaf4ef0f71b6c04e

SHA512
618d7b4344782275ec6445380b9db372bb6c51315e188933d3d580cad97a83aaefccfdf1486dc1778201967e6353b88d26815b9cc248a905b86b208f3ea53a22

Download Submit
C:\Windows\SysWOW64\akvoglnialxnwfp.exe
Filesize
255KB

MD5
e39a6d0ded7e312a60a042dd38e66a73

SHA1
725ec5c65de40c9cff5e292961524d1a9e5558e6

SHA256
8430ef8a22a2c280b954445a2fb43cd9d50e734bbe8eac96aaf4ef0f71b6c04e

SHA512
618d7b4344782275ec6445380b9db372bb6c51315e188933d3d580cad97a83aaefccfdf1486dc1778201967e6353b88d26815b9cc248a905b86b208f3ea53a22

Download Submit
C:\Windows\SysWOW64\rypijqzo.exe
Filesize
255KB

MD5
9bd54a1d1927de56b8267c7dadd714f7

SHA1
e1f652c96866444827d78fd20b4b516921ac7b11

SHA256
f178b749af097cb8326222016c739d2c6d655caeb9882e26f27d9eff869c0ce3

SHA512
f1b865a29a26b4693aa63d49a408cfe458ae8ad7670e061914fb3dce658845004623599848380ec5055fad00a732d02a3a5b309e97f0fb2ae26601564faf8c09

Download Submit
C:\Windows\SysWOW64\rypijqzo.exe
Filesize
255KB

MD5
9bd54a1d1927de56b8267c7dadd714f7

SHA1
e1f652c96866444827d78fd20b4b516921ac7b11

SHA256
f178b749af097cb8326222016c739d2c6d655caeb9882e26f27d9eff869c0ce3

SHA512
f1b865a29a26b4693aa63d49a408cfe458ae8ad7670e061914fb3dce658845004623599848380ec5055fad00a732d02a3a5b309e97f0fb2ae26601564faf8c09

Download Submit
C:\Windows\SysWOW64\rypijqzo.exe
Filesize
255KB

MD5
9bd54a1d1927de56b8267c7dadd714f7

SHA1
e1f652c96866444827d78fd20b4b516921ac7b11

SHA256
f178b749af097cb8326222016c739d2c6d655caeb9882e26f27d9eff869c0ce3

SHA512
f1b865a29a26b4693aa63d49a408cfe458ae8ad7670e061914fb3dce658845004623599848380ec5055fad00a732d02a3a5b309e97f0fb2ae26601564faf8c09

Download Submit
C:\Windows\SysWOW64\vvvzjnnhlz.exe
Filesize
255KB

MD5
67ad1d4056c5a8dee77d502e493960ff

SHA1
bc1062a92996e098fa26f2c4bc1eaf331d9212d5

SHA256
00ab0741fa68df35a88136bb60e7e7ffa4e5e2150a1c4433633f163338abf167

SHA512
450dafd7888f4f7ace3991da901be1eb2978ae7446c7b14c37985f3797cedc7016ebe6ee7771fb1d8be626cb3ce3b5efed160cd8cd348f95fcfd0f193c00bb98

Download Submit
C:\Windows\SysWOW64\vvvzjnnhlz.exe
Filesize
255KB

MD5
67ad1d4056c5a8dee77d502e493960ff

SHA1
bc1062a92996e098fa26f2c4bc1eaf331d9212d5

SHA256
00ab0741fa68df35a88136bb60e7e7ffa4e5e2150a1c4433633f163338abf167

SHA512
450dafd7888f4f7ace3991da901be1eb2978ae7446c7b14c37985f3797cedc7016ebe6ee7771fb1d8be626cb3ce3b5efed160cd8cd348f95fcfd0f193c00bb98

Download Submit
C:\Windows\SysWOW64\zlbnrdgrojqno.exe
Filesize
255KB

MD5
f6bdaebda8c4e7f7e508a8eb32ff09d3

SHA1
fb6380dbfa41278fdfe2ef3cd4f582e08f94e3e6

SHA256
13c62f2a90e4129ea972b01f7b3aacf0bac1ef4d2251457971b8b5382c950a90

SHA512
2a9380bba869eeafb69a4045eea8dafbc65e0b7beb53ef5990fd567ad3d578b2e307c9cdb9f1b73b9cb347355406354981f3a36891f6e92e9461e0e8a01b2c9f

Download Submit
C:\Windows\SysWOW64\zlbnrdgrojqno.exe
Filesize
255KB

MD5
f6bdaebda8c4e7f7e508a8eb32ff09d3

SHA1
fb6380dbfa41278fdfe2ef3cd4f582e08f94e3e6

SHA256
13c62f2a90e4129ea972b01f7b3aacf0bac1ef4d2251457971b8b5382c950a90

SHA512
2a9380bba869eeafb69a4045eea8dafbc65e0b7beb53ef5990fd567ad3d578b2e307c9cdb9f1b73b9cb347355406354981f3a36891f6e92e9461e0e8a01b2c9f

Download Submit
C:\Windows\mydoc.rtf
Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\akvoglnialxnwfp.exe
Filesize
255KB

MD5
e39a6d0ded7e312a60a042dd38e66a73

SHA1
725ec5c65de40c9cff5e292961524d1a9e5558e6

SHA256
8430ef8a22a2c280b954445a2fb43cd9d50e734bbe8eac96aaf4ef0f71b6c04e

SHA512
618d7b4344782275ec6445380b9db372bb6c51315e188933d3d580cad97a83aaefccfdf1486dc1778201967e6353b88d26815b9cc248a905b86b208f3ea53a22

Download Submit
\Windows\SysWOW64\rypijqzo.exe
Filesize
255KB

MD5
9bd54a1d1927de56b8267c7dadd714f7

SHA1
e1f652c96866444827d78fd20b4b516921ac7b11

SHA256
f178b749af097cb8326222016c739d2c6d655caeb9882e26f27d9eff869c0ce3

SHA512
f1b865a29a26b4693aa63d49a408cfe458ae8ad7670e061914fb3dce658845004623599848380ec5055fad00a732d02a3a5b309e97f0fb2ae26601564faf8c09

Download Submit
\Windows\SysWOW64\rypijqzo.exe
Filesize
255KB

MD5
9bd54a1d1927de56b8267c7dadd714f7

SHA1
e1f652c96866444827d78fd20b4b516921ac7b11

SHA256
f178b749af097cb8326222016c739d2c6d655caeb9882e26f27d9eff869c0ce3

SHA512
f1b865a29a26b4693aa63d49a408cfe458ae8ad7670e061914fb3dce658845004623599848380ec5055fad00a732d02a3a5b309e97f0fb2ae26601564faf8c09

Download Submit
\Windows\SysWOW64\vvvzjnnhlz.exe
Filesize
255KB

MD5
67ad1d4056c5a8dee77d502e493960ff

SHA1
bc1062a92996e098fa26f2c4bc1eaf331d9212d5

SHA256
00ab0741fa68df35a88136bb60e7e7ffa4e5e2150a1c4433633f163338abf167

SHA512
450dafd7888f4f7ace3991da901be1eb2978ae7446c7b14c37985f3797cedc7016ebe6ee7771fb1d8be626cb3ce3b5efed160cd8cd348f95fcfd0f193c00bb98

Download Submit
\Windows\SysWOW64\zlbnrdgrojqno.exe
Filesize
255KB

MD5
f6bdaebda8c4e7f7e508a8eb32ff09d3

SHA1
fb6380dbfa41278fdfe2ef3cd4f582e08f94e3e6

SHA256
13c62f2a90e4129ea972b01f7b3aacf0bac1ef4d2251457971b8b5382c950a90

SHA512
2a9380bba869eeafb69a4045eea8dafbc65e0b7beb53ef5990fd567ad3d578b2e307c9cdb9f1b73b9cb347355406354981f3a36891f6e92e9461e0e8a01b2c9f

Download Submit
memory/520-66-0x0000000000000000-mapping.dmp

Download
memory/520-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/520-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/556-87-0x0000000003890000-0x0000000003930000-memory.dmp

Filesize
640KB

Download
memory/556-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/556-57-0x0000000000000000-mapping.dmp

Download
memory/556-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/616-77-0x0000000000000000-mapping.dmp

Download
memory/616-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/616-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/652-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/652-61-0x0000000000000000-mapping.dmp

Download
memory/652-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1080-90-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1080-86-0x0000000072C11000-0x0000000072C14000-memory.dmp

Filesize
12KB

Download
memory/1080-104-0x000000007167D000-0x0000000071688000-memory.dmp

Filesize
44KB

Download
memory/1080-91-0x000000007167D000-0x0000000071688000-memory.dmp

Filesize
44KB

Download
memory/1080-103-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1080-100-0x000000007167D000-0x0000000071688000-memory.dmp

Filesize
44KB

Download
memory/1080-80-0x0000000000000000-mapping.dmp

Download
memory/1080-89-0x0000000070691000-0x0000000070693000-memory.dmp

Filesize
8KB

Download
memory/1248-70-0x0000000000000000-mapping.dmp

Download
memory/1248-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1248-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1740-54-0x0000000076531000-0x0000000076533000-memory.dmp

Filesize
8KB

Download
memory/1740-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1740-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1880-101-0x0000000000000000-mapping.dmp

Download
memory/1880-102-0x000007FEFC071000-0x000007FEFC073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads