Analysis
-
max time kernel
201s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:03
Behavioral task
behavioral1
Sample
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe
Resource
win10v2004-20221111-en
General
-
Target
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe
-
Size
255KB
-
MD5
d86fd9e9ef6f00c85baaebffaa19db7d
-
SHA1
f9d565de0eab70a2257ee48df13f061f810a3845
-
SHA256
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b
-
SHA512
8b1e9bd0cd244cc2ccbef3ec16ab3f96c4e0314a570274e7ed2d8449cc466fe1e83eb0ab232796589e229507b2cba9c72e1c3b9f8bfe9ddfbdc85fd6e92b22c5
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJP:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI8
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
tabjwcrmky.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tabjwcrmky.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
tabjwcrmky.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tabjwcrmky.exe -
Processes:
tabjwcrmky.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tabjwcrmky.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
tabjwcrmky.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tabjwcrmky.exe -
Executes dropped EXE 5 IoCs
Processes:
tabjwcrmky.exeyregrdrjqeemygh.exelngjahvm.exefsbvpoxwuvesy.exelngjahvm.exepid process 952 tabjwcrmky.exe 1400 yregrdrjqeemygh.exe 1292 lngjahvm.exe 1520 fsbvpoxwuvesy.exe 1836 lngjahvm.exe -
Processes:
resource yara_rule behavioral1/memory/1376-54-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\tabjwcrmky.exe upx behavioral1/memory/1376-57-0x00000000032E0000-0x0000000003380000-memory.dmp upx C:\Windows\SysWOW64\tabjwcrmky.exe upx \Windows\SysWOW64\yregrdrjqeemygh.exe upx C:\Windows\SysWOW64\tabjwcrmky.exe upx C:\Windows\SysWOW64\yregrdrjqeemygh.exe upx \Windows\SysWOW64\lngjahvm.exe upx C:\Windows\SysWOW64\lngjahvm.exe upx C:\Windows\SysWOW64\yregrdrjqeemygh.exe upx \Windows\SysWOW64\fsbvpoxwuvesy.exe upx C:\Windows\SysWOW64\fsbvpoxwuvesy.exe upx C:\Windows\SysWOW64\lngjahvm.exe upx C:\Windows\SysWOW64\fsbvpoxwuvesy.exe upx \Windows\SysWOW64\lngjahvm.exe upx C:\Windows\SysWOW64\lngjahvm.exe upx behavioral1/memory/952-81-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1400-83-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1292-84-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1520-85-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1836-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1376-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/952-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1400-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1292-97-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1520-98-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1836-99-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Users\Admin\Documents\ConvertToRevoke.doc.exe upx C:\Users\Admin\Downloads\ApproveCopy.doc.exe upx -
Loads dropped DLL 5 IoCs
Processes:
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exetabjwcrmky.exepid process 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 952 tabjwcrmky.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tabjwcrmky.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tabjwcrmky.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
yregrdrjqeemygh.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run yregrdrjqeemygh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ladnduvr = "tabjwcrmky.exe" yregrdrjqeemygh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yurveuhr = "yregrdrjqeemygh.exe" yregrdrjqeemygh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "fsbvpoxwuvesy.exe" yregrdrjqeemygh.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
lngjahvm.exelngjahvm.exetabjwcrmky.exedescription ioc process File opened (read-only) \??\a: lngjahvm.exe File opened (read-only) \??\b: lngjahvm.exe File opened (read-only) \??\f: lngjahvm.exe File opened (read-only) \??\z: lngjahvm.exe File opened (read-only) \??\n: lngjahvm.exe File opened (read-only) \??\o: lngjahvm.exe File opened (read-only) \??\f: tabjwcrmky.exe File opened (read-only) \??\j: tabjwcrmky.exe File opened (read-only) \??\b: lngjahvm.exe File opened (read-only) \??\i: lngjahvm.exe File opened (read-only) \??\l: tabjwcrmky.exe File opened (read-only) \??\m: tabjwcrmky.exe File opened (read-only) \??\t: tabjwcrmky.exe File opened (read-only) \??\z: tabjwcrmky.exe File opened (read-only) \??\l: lngjahvm.exe File opened (read-only) \??\s: lngjahvm.exe File opened (read-only) \??\t: lngjahvm.exe File opened (read-only) \??\w: lngjahvm.exe File opened (read-only) \??\k: lngjahvm.exe File opened (read-only) \??\s: tabjwcrmky.exe File opened (read-only) \??\k: lngjahvm.exe File opened (read-only) \??\m: lngjahvm.exe File opened (read-only) \??\v: lngjahvm.exe File opened (read-only) \??\r: tabjwcrmky.exe File opened (read-only) \??\m: lngjahvm.exe File opened (read-only) \??\w: lngjahvm.exe File opened (read-only) \??\x: lngjahvm.exe File opened (read-only) \??\h: tabjwcrmky.exe File opened (read-only) \??\p: tabjwcrmky.exe File opened (read-only) \??\q: tabjwcrmky.exe File opened (read-only) \??\x: lngjahvm.exe File opened (read-only) \??\y: lngjahvm.exe File opened (read-only) \??\j: lngjahvm.exe File opened (read-only) \??\g: tabjwcrmky.exe File opened (read-only) \??\l: lngjahvm.exe File opened (read-only) \??\r: lngjahvm.exe File opened (read-only) \??\n: lngjahvm.exe File opened (read-only) \??\k: tabjwcrmky.exe File opened (read-only) \??\y: tabjwcrmky.exe File opened (read-only) \??\i: lngjahvm.exe File opened (read-only) \??\j: lngjahvm.exe File opened (read-only) \??\a: lngjahvm.exe File opened (read-only) \??\e: lngjahvm.exe File opened (read-only) \??\f: lngjahvm.exe File opened (read-only) \??\h: lngjahvm.exe File opened (read-only) \??\y: lngjahvm.exe File opened (read-only) \??\a: tabjwcrmky.exe File opened (read-only) \??\i: tabjwcrmky.exe File opened (read-only) \??\o: lngjahvm.exe File opened (read-only) \??\w: tabjwcrmky.exe File opened (read-only) \??\r: lngjahvm.exe File opened (read-only) \??\z: lngjahvm.exe File opened (read-only) \??\e: tabjwcrmky.exe File opened (read-only) \??\u: tabjwcrmky.exe File opened (read-only) \??\u: lngjahvm.exe File opened (read-only) \??\b: tabjwcrmky.exe File opened (read-only) \??\e: lngjahvm.exe File opened (read-only) \??\u: lngjahvm.exe File opened (read-only) \??\g: lngjahvm.exe File opened (read-only) \??\p: lngjahvm.exe File opened (read-only) \??\s: lngjahvm.exe File opened (read-only) \??\v: lngjahvm.exe File opened (read-only) \??\g: lngjahvm.exe File opened (read-only) \??\p: lngjahvm.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
tabjwcrmky.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" tabjwcrmky.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" tabjwcrmky.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/952-81-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1400-83-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1292-84-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1520-85-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1836-86-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1376-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/952-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1400-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1292-97-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1520-98-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1836-99-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exetabjwcrmky.exedescription ioc process File opened for modification C:\Windows\SysWOW64\tabjwcrmky.exe 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe File opened for modification C:\Windows\SysWOW64\yregrdrjqeemygh.exe 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe File created C:\Windows\SysWOW64\lngjahvm.exe 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe File created C:\Windows\SysWOW64\fsbvpoxwuvesy.exe 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll tabjwcrmky.exe File created C:\Windows\SysWOW64\tabjwcrmky.exe 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe File created C:\Windows\SysWOW64\yregrdrjqeemygh.exe 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe File opened for modification C:\Windows\SysWOW64\lngjahvm.exe 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe File opened for modification C:\Windows\SysWOW64\fsbvpoxwuvesy.exe 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe -
Drops file in Program Files directory 14 IoCs
Processes:
lngjahvm.exelngjahvm.exedescription ioc process File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lngjahvm.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lngjahvm.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lngjahvm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal lngjahvm.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lngjahvm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lngjahvm.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lngjahvm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lngjahvm.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lngjahvm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal lngjahvm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe lngjahvm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal lngjahvm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe lngjahvm.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal lngjahvm.exe -
Drops file in Windows directory 5 IoCs
Processes:
WINWORD.EXE7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exedescription ioc process File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXE7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exetabjwcrmky.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C77414E0DBC4B8C17FE1ED9637CB" 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBCF9CDF913F1E7840B3B45819939E2B38E02F14314034FE2BE42E708A2" 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc tabjwcrmky.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1040 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exetabjwcrmky.exeyregrdrjqeemygh.exelngjahvm.exefsbvpoxwuvesy.exelngjahvm.exepid process 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 952 tabjwcrmky.exe 952 tabjwcrmky.exe 952 tabjwcrmky.exe 952 tabjwcrmky.exe 952 tabjwcrmky.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1400 yregrdrjqeemygh.exe 1400 yregrdrjqeemygh.exe 1400 yregrdrjqeemygh.exe 1400 yregrdrjqeemygh.exe 1400 yregrdrjqeemygh.exe 1292 lngjahvm.exe 1292 lngjahvm.exe 1292 lngjahvm.exe 1292 lngjahvm.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1836 lngjahvm.exe 1836 lngjahvm.exe 1836 lngjahvm.exe 1836 lngjahvm.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1400 yregrdrjqeemygh.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exetabjwcrmky.exeyregrdrjqeemygh.exelngjahvm.exefsbvpoxwuvesy.exelngjahvm.exepid process 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 952 tabjwcrmky.exe 952 tabjwcrmky.exe 952 tabjwcrmky.exe 1400 yregrdrjqeemygh.exe 1400 yregrdrjqeemygh.exe 1400 yregrdrjqeemygh.exe 1292 lngjahvm.exe 1292 lngjahvm.exe 1292 lngjahvm.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1836 lngjahvm.exe 1836 lngjahvm.exe 1836 lngjahvm.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exetabjwcrmky.exeyregrdrjqeemygh.exelngjahvm.exefsbvpoxwuvesy.exelngjahvm.exepid process 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe 952 tabjwcrmky.exe 952 tabjwcrmky.exe 952 tabjwcrmky.exe 1400 yregrdrjqeemygh.exe 1400 yregrdrjqeemygh.exe 1400 yregrdrjqeemygh.exe 1292 lngjahvm.exe 1292 lngjahvm.exe 1292 lngjahvm.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1520 fsbvpoxwuvesy.exe 1836 lngjahvm.exe 1836 lngjahvm.exe 1836 lngjahvm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1040 WINWORD.EXE 1040 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exetabjwcrmky.exeWINWORD.EXEdescription pid process target process PID 1376 wrote to memory of 952 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe tabjwcrmky.exe PID 1376 wrote to memory of 952 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe tabjwcrmky.exe PID 1376 wrote to memory of 952 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe tabjwcrmky.exe PID 1376 wrote to memory of 952 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe tabjwcrmky.exe PID 1376 wrote to memory of 1400 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe yregrdrjqeemygh.exe PID 1376 wrote to memory of 1400 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe yregrdrjqeemygh.exe PID 1376 wrote to memory of 1400 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe yregrdrjqeemygh.exe PID 1376 wrote to memory of 1400 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe yregrdrjqeemygh.exe PID 1376 wrote to memory of 1292 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe lngjahvm.exe PID 1376 wrote to memory of 1292 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe lngjahvm.exe PID 1376 wrote to memory of 1292 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe lngjahvm.exe PID 1376 wrote to memory of 1292 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe lngjahvm.exe PID 1376 wrote to memory of 1520 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe fsbvpoxwuvesy.exe PID 1376 wrote to memory of 1520 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe fsbvpoxwuvesy.exe PID 1376 wrote to memory of 1520 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe fsbvpoxwuvesy.exe PID 1376 wrote to memory of 1520 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe fsbvpoxwuvesy.exe PID 952 wrote to memory of 1836 952 tabjwcrmky.exe lngjahvm.exe PID 952 wrote to memory of 1836 952 tabjwcrmky.exe lngjahvm.exe PID 952 wrote to memory of 1836 952 tabjwcrmky.exe lngjahvm.exe PID 952 wrote to memory of 1836 952 tabjwcrmky.exe lngjahvm.exe PID 1376 wrote to memory of 1040 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe WINWORD.EXE PID 1376 wrote to memory of 1040 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe WINWORD.EXE PID 1376 wrote to memory of 1040 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe WINWORD.EXE PID 1376 wrote to memory of 1040 1376 7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe WINWORD.EXE PID 1040 wrote to memory of 1708 1040 WINWORD.EXE splwow64.exe PID 1040 wrote to memory of 1708 1040 WINWORD.EXE splwow64.exe PID 1040 wrote to memory of 1708 1040 WINWORD.EXE splwow64.exe PID 1040 wrote to memory of 1708 1040 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe"C:\Users\Admin\AppData\Local\Temp\7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tabjwcrmky.exetabjwcrmky.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\lngjahvm.exeC:\Windows\system32\lngjahvm.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\yregrdrjqeemygh.exeyregrdrjqeemygh.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\lngjahvm.exelngjahvm.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\fsbvpoxwuvesy.exefsbvpoxwuvesy.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
7Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\ConvertToRevoke.doc.exeFilesize
255KB
MD539f35736ef4bf4b4bc3c0dfcab2aeeb3
SHA1859f1dcb1062974c29c4a8aeaad1412ff98c2f90
SHA256d98a0b161ef31b43d79df683b30bf1b36c671d587b406fa12d92cf814a07deaf
SHA512fad3b0d867994447acaba1bbc49109d7e4db1438206ec7e2b0bb34eb87129f8e1dd6c4ac07d3d17fc0628c1ff25f47453fac388e1d8d1056623ddef57bd75fea
-
C:\Users\Admin\Downloads\ApproveCopy.doc.exeFilesize
255KB
MD5ec2d84f6da4a3e2e7dbcf1a7ede5c32f
SHA134c501c9e682fe0a6133446ec8c4a7ae7e57129b
SHA256dd9e9b6a4018f5403f2f9171f5f0395d123763ab24a7ca2302ee4108e6a0c0c0
SHA512727b1c070247457b6eb62a014f3422a733a74f20b8b213dcf5950ae765002733b12186a0d6a48934997786af33ded4d5ed19f7dec1e2d8bae9ca386803b077d7
-
C:\Windows\SysWOW64\fsbvpoxwuvesy.exeFilesize
255KB
MD57c3b2ca448cf1d8285924e0aa9d193ba
SHA1ee22876d0a36bcf71595c4fc8fa6b7684d0d423c
SHA256c33b70a593c1e0a214b65d604fed3eb5b99b15e1e62e1f20dc13bb6449594a50
SHA512bb694f63fe45d746fe1fefc0f754d5743b30d497df6591abd58241b2ce24e0df874cd9a568e063549dfa473e77e179589431822a05e67207c327cf4a24812f71
-
C:\Windows\SysWOW64\fsbvpoxwuvesy.exeFilesize
255KB
MD57c3b2ca448cf1d8285924e0aa9d193ba
SHA1ee22876d0a36bcf71595c4fc8fa6b7684d0d423c
SHA256c33b70a593c1e0a214b65d604fed3eb5b99b15e1e62e1f20dc13bb6449594a50
SHA512bb694f63fe45d746fe1fefc0f754d5743b30d497df6591abd58241b2ce24e0df874cd9a568e063549dfa473e77e179589431822a05e67207c327cf4a24812f71
-
C:\Windows\SysWOW64\lngjahvm.exeFilesize
255KB
MD5253a5ded2496b64c8dafd2a152c84e7e
SHA11b489d5726df8e4d3bab69dd960fc3ea4b2fe861
SHA2560f2bbddb9aee70a7a4aa412bfab02f45dfc188e6ba0096f2226c4371fdeac6dd
SHA5120995cf1d37b5ba97f9c3a6421605400e63442baf4378f5b461c2ce3a02155c416795d1783bc5347ef92b59cecd954afaf6bf37cbeab1f749ce25d6dadf97201d
-
C:\Windows\SysWOW64\lngjahvm.exeFilesize
255KB
MD5253a5ded2496b64c8dafd2a152c84e7e
SHA11b489d5726df8e4d3bab69dd960fc3ea4b2fe861
SHA2560f2bbddb9aee70a7a4aa412bfab02f45dfc188e6ba0096f2226c4371fdeac6dd
SHA5120995cf1d37b5ba97f9c3a6421605400e63442baf4378f5b461c2ce3a02155c416795d1783bc5347ef92b59cecd954afaf6bf37cbeab1f749ce25d6dadf97201d
-
C:\Windows\SysWOW64\lngjahvm.exeFilesize
255KB
MD5253a5ded2496b64c8dafd2a152c84e7e
SHA11b489d5726df8e4d3bab69dd960fc3ea4b2fe861
SHA2560f2bbddb9aee70a7a4aa412bfab02f45dfc188e6ba0096f2226c4371fdeac6dd
SHA5120995cf1d37b5ba97f9c3a6421605400e63442baf4378f5b461c2ce3a02155c416795d1783bc5347ef92b59cecd954afaf6bf37cbeab1f749ce25d6dadf97201d
-
C:\Windows\SysWOW64\tabjwcrmky.exeFilesize
255KB
MD5c8e967a46f0df32acd4ae2d6dee93014
SHA1bc2cc0982fde46da223ad0fe550b3e575f8b12be
SHA256933408bbf4f7299b3c2a21d407cd9cd6c0ce5248743158389d13d28089b2ae94
SHA51232d884e094fab5e1157f93aec13b7d8ba8578ecd85a0f63e29117eadffc1b020f93882a8a469be6473ff53affdd98460940a4f88de384548aa91c96465acd0af
-
C:\Windows\SysWOW64\tabjwcrmky.exeFilesize
255KB
MD5c8e967a46f0df32acd4ae2d6dee93014
SHA1bc2cc0982fde46da223ad0fe550b3e575f8b12be
SHA256933408bbf4f7299b3c2a21d407cd9cd6c0ce5248743158389d13d28089b2ae94
SHA51232d884e094fab5e1157f93aec13b7d8ba8578ecd85a0f63e29117eadffc1b020f93882a8a469be6473ff53affdd98460940a4f88de384548aa91c96465acd0af
-
C:\Windows\SysWOW64\yregrdrjqeemygh.exeFilesize
255KB
MD50e3e7178b29e3078dd1ba1a735e95b9d
SHA1c4a3ac8d84d1d1cb897474cc948c197534b5ed5d
SHA25684c1e5559b472dad6182b81e5c1592d466245eb7d577f4020185d1ff52d91d67
SHA512691440c2d546ad443b5ace0728a928b1f40043a5afd022489dff7cff6a24dae974d0838bbdee3a26a5a61f5773ad734908fba237a8d3623d626cfc9ef6a63002
-
C:\Windows\SysWOW64\yregrdrjqeemygh.exeFilesize
255KB
MD50e3e7178b29e3078dd1ba1a735e95b9d
SHA1c4a3ac8d84d1d1cb897474cc948c197534b5ed5d
SHA25684c1e5559b472dad6182b81e5c1592d466245eb7d577f4020185d1ff52d91d67
SHA512691440c2d546ad443b5ace0728a928b1f40043a5afd022489dff7cff6a24dae974d0838bbdee3a26a5a61f5773ad734908fba237a8d3623d626cfc9ef6a63002
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\Windows\SysWOW64\fsbvpoxwuvesy.exeFilesize
255KB
MD57c3b2ca448cf1d8285924e0aa9d193ba
SHA1ee22876d0a36bcf71595c4fc8fa6b7684d0d423c
SHA256c33b70a593c1e0a214b65d604fed3eb5b99b15e1e62e1f20dc13bb6449594a50
SHA512bb694f63fe45d746fe1fefc0f754d5743b30d497df6591abd58241b2ce24e0df874cd9a568e063549dfa473e77e179589431822a05e67207c327cf4a24812f71
-
\Windows\SysWOW64\lngjahvm.exeFilesize
255KB
MD5253a5ded2496b64c8dafd2a152c84e7e
SHA11b489d5726df8e4d3bab69dd960fc3ea4b2fe861
SHA2560f2bbddb9aee70a7a4aa412bfab02f45dfc188e6ba0096f2226c4371fdeac6dd
SHA5120995cf1d37b5ba97f9c3a6421605400e63442baf4378f5b461c2ce3a02155c416795d1783bc5347ef92b59cecd954afaf6bf37cbeab1f749ce25d6dadf97201d
-
\Windows\SysWOW64\lngjahvm.exeFilesize
255KB
MD5253a5ded2496b64c8dafd2a152c84e7e
SHA11b489d5726df8e4d3bab69dd960fc3ea4b2fe861
SHA2560f2bbddb9aee70a7a4aa412bfab02f45dfc188e6ba0096f2226c4371fdeac6dd
SHA5120995cf1d37b5ba97f9c3a6421605400e63442baf4378f5b461c2ce3a02155c416795d1783bc5347ef92b59cecd954afaf6bf37cbeab1f749ce25d6dadf97201d
-
\Windows\SysWOW64\tabjwcrmky.exeFilesize
255KB
MD5c8e967a46f0df32acd4ae2d6dee93014
SHA1bc2cc0982fde46da223ad0fe550b3e575f8b12be
SHA256933408bbf4f7299b3c2a21d407cd9cd6c0ce5248743158389d13d28089b2ae94
SHA51232d884e094fab5e1157f93aec13b7d8ba8578ecd85a0f63e29117eadffc1b020f93882a8a469be6473ff53affdd98460940a4f88de384548aa91c96465acd0af
-
\Windows\SysWOW64\yregrdrjqeemygh.exeFilesize
255KB
MD50e3e7178b29e3078dd1ba1a735e95b9d
SHA1c4a3ac8d84d1d1cb897474cc948c197534b5ed5d
SHA25684c1e5559b472dad6182b81e5c1592d466245eb7d577f4020185d1ff52d91d67
SHA512691440c2d546ad443b5ace0728a928b1f40043a5afd022489dff7cff6a24dae974d0838bbdee3a26a5a61f5773ad734908fba237a8d3623d626cfc9ef6a63002
-
memory/952-81-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/952-95-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/952-58-0x0000000000000000-mapping.dmp
-
memory/1040-87-0x0000000000000000-mapping.dmp
-
memory/1040-105-0x000000007170D000-0x0000000071718000-memory.dmpFilesize
44KB
-
memory/1040-104-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1040-94-0x000000007170D000-0x0000000071718000-memory.dmpFilesize
44KB
-
memory/1040-91-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1040-90-0x0000000070721000-0x0000000070723000-memory.dmpFilesize
8KB
-
memory/1040-89-0x0000000072CA1000-0x0000000072CA4000-memory.dmpFilesize
12KB
-
memory/1292-84-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1292-97-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1292-67-0x0000000000000000-mapping.dmp
-
memory/1376-88-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1376-55-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1376-57-0x00000000032E0000-0x0000000003380000-memory.dmpFilesize
640KB
-
memory/1376-82-0x00000000032E0000-0x0000000003380000-memory.dmpFilesize
640KB
-
memory/1376-54-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1400-96-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1400-62-0x0000000000000000-mapping.dmp
-
memory/1400-83-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1520-98-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1520-85-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1520-72-0x0000000000000000-mapping.dmp
-
memory/1708-100-0x0000000000000000-mapping.dmp
-
memory/1708-101-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmpFilesize
8KB
-
memory/1836-86-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1836-99-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1836-78-0x0000000000000000-mapping.dmp