3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41

Analysis

max time kernel
154s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
Size

255KB
MD5

8bf8446ae5f65addbf2074cb719aeeb3
SHA1

9c352f8284abb84e8ac19dd4ddd02d1974b7b6fd
SHA256

3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41
SHA512

57fbca89fa2bd8119fe944a1f646eee22e4fe87a25740b1a4eb79e40abbca912723a87831d5f92e26c92d05641011b308f79502aedc4927a88e275fffbcad14a
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJy:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIj

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

uxcivcsnll.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	uxcivcsnll.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

uxcivcsnll.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	uxcivcsnll.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

uxcivcsnll.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	uxcivcsnll.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

uxcivcsnll.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uxcivcsnll.exe

Executes dropped EXE 5 IoCs

Processes:

uxcivcsnll.exexseqmwte.exeqkbergnevpaqxbw.exedqiscqvrjijpn.exexseqmwte.exe

pid process

1620 uxcivcsnll.exe
1576 xseqmwte.exe
1696 qkbergnevpaqxbw.exe
1404 dqiscqvrjijpn.exe
1884 xseqmwte.exe

pid	process
1620	uxcivcsnll.exe
1576	xseqmwte.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1884	xseqmwte.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\uxcivcsnll.exe	upx
C:\Windows\SysWOW64\uxcivcsnll.exe	upx
\Windows\SysWOW64\qkbergnevpaqxbw.exe	upx
C:\Windows\SysWOW64\uxcivcsnll.exe	upx
\Windows\SysWOW64\xseqmwte.exe	upx
C:\Windows\SysWOW64\xseqmwte.exe	upx
C:\Windows\SysWOW64\qkbergnevpaqxbw.exe	upx
\Windows\SysWOW64\dqiscqvrjijpn.exe	upx
C:\Windows\SysWOW64\xseqmwte.exe	upx
C:\Windows\SysWOW64\dqiscqvrjijpn.exe	upx
C:\Windows\SysWOW64\qkbergnevpaqxbw.exe	upx
C:\Windows\SysWOW64\dqiscqvrjijpn.exe	upx
behavioral1/memory/1044-75-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1620-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1576-78-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1404-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1696-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\xseqmwte.exe	upx
C:\Windows\SysWOW64\xseqmwte.exe	upx
behavioral1/memory/1044-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1884-90-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1620-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1576-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1696-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1404-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1884-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	upx
C:\Users\Admin\AppData\Roaming\CompleteApprove.doc.exe	upx

Loads dropped DLL 5 IoCs

Processes:

3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exeuxcivcsnll.exe

pid	process
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1620	uxcivcsnll.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

uxcivcsnll.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	uxcivcsnll.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

qkbergnevpaqxbw.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vfazblky = "qkbergnevpaqxbw.exe"	qkbergnevpaqxbw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "dqiscqvrjijpn.exe"	qkbergnevpaqxbw.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	qkbergnevpaqxbw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cgdyaqru = "uxcivcsnll.exe"	qkbergnevpaqxbw.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

xseqmwte.exeuxcivcsnll.exexseqmwte.exe

description	ioc	process
File opened (read-only)	\??\i:	xseqmwte.exe
File opened (read-only)	\??\h:	uxcivcsnll.exe
File opened (read-only)	\??\p:	uxcivcsnll.exe
File opened (read-only)	\??\h:	xseqmwte.exe
File opened (read-only)	\??\q:	xseqmwte.exe
File opened (read-only)	\??\m:	uxcivcsnll.exe
File opened (read-only)	\??\n:	uxcivcsnll.exe
File opened (read-only)	\??\q:	uxcivcsnll.exe
File opened (read-only)	\??\n:	xseqmwte.exe
File opened (read-only)	\??\r:	xseqmwte.exe
File opened (read-only)	\??\h:	xseqmwte.exe
File opened (read-only)	\??\l:	xseqmwte.exe
File opened (read-only)	\??\v:	xseqmwte.exe
File opened (read-only)	\??\s:	uxcivcsnll.exe
File opened (read-only)	\??\g:	xseqmwte.exe
File opened (read-only)	\??\k:	xseqmwte.exe
File opened (read-only)	\??\g:	uxcivcsnll.exe
File opened (read-only)	\??\r:	uxcivcsnll.exe
File opened (read-only)	\??\w:	xseqmwte.exe
File opened (read-only)	\??\b:	uxcivcsnll.exe
File opened (read-only)	\??\b:	xseqmwte.exe
File opened (read-only)	\??\i:	xseqmwte.exe
File opened (read-only)	\??\v:	xseqmwte.exe
File opened (read-only)	\??\p:	xseqmwte.exe
File opened (read-only)	\??\a:	uxcivcsnll.exe
File opened (read-only)	\??\z:	uxcivcsnll.exe
File opened (read-only)	\??\k:	xseqmwte.exe
File opened (read-only)	\??\m:	xseqmwte.exe
File opened (read-only)	\??\o:	xseqmwte.exe
File opened (read-only)	\??\r:	xseqmwte.exe
File opened (read-only)	\??\e:	xseqmwte.exe
File opened (read-only)	\??\u:	xseqmwte.exe
File opened (read-only)	\??\x:	xseqmwte.exe
File opened (read-only)	\??\s:	xseqmwte.exe
File opened (read-only)	\??\o:	uxcivcsnll.exe
File opened (read-only)	\??\t:	uxcivcsnll.exe
File opened (read-only)	\??\a:	xseqmwte.exe
File opened (read-only)	\??\m:	xseqmwte.exe
File opened (read-only)	\??\b:	xseqmwte.exe
File opened (read-only)	\??\n:	xseqmwte.exe
File opened (read-only)	\??\k:	uxcivcsnll.exe
File opened (read-only)	\??\x:	uxcivcsnll.exe
File opened (read-only)	\??\e:	xseqmwte.exe
File opened (read-only)	\??\l:	xseqmwte.exe
File opened (read-only)	\??\a:	xseqmwte.exe
File opened (read-only)	\??\u:	xseqmwte.exe
File opened (read-only)	\??\l:	uxcivcsnll.exe
File opened (read-only)	\??\f:	xseqmwte.exe
File opened (read-only)	\??\j:	xseqmwte.exe
File opened (read-only)	\??\f:	xseqmwte.exe
File opened (read-only)	\??\t:	xseqmwte.exe
File opened (read-only)	\??\x:	xseqmwte.exe
File opened (read-only)	\??\e:	uxcivcsnll.exe
File opened (read-only)	\??\y:	uxcivcsnll.exe
File opened (read-only)	\??\f:	uxcivcsnll.exe
File opened (read-only)	\??\j:	uxcivcsnll.exe
File opened (read-only)	\??\o:	xseqmwte.exe
File opened (read-only)	\??\s:	xseqmwte.exe
File opened (read-only)	\??\y:	xseqmwte.exe
File opened (read-only)	\??\g:	xseqmwte.exe
File opened (read-only)	\??\y:	xseqmwte.exe
File opened (read-only)	\??\z:	xseqmwte.exe
File opened (read-only)	\??\i:	uxcivcsnll.exe
File opened (read-only)	\??\v:	uxcivcsnll.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

uxcivcsnll.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	uxcivcsnll.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	uxcivcsnll.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1044-75-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1620-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1576-78-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1044-80-0x00000000033B0000-0x0000000003450000-memory.dmp	autoit_exe
behavioral1/memory/1404-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1696-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1044-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1884-90-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1620-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1576-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1696-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1404-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1884-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exeuxcivcsnll.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\qkbergnevpaqxbw.exe	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
File opened for modification	C:\Windows\SysWOW64\xseqmwte.exe	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
File created	C:\Windows\SysWOW64\dqiscqvrjijpn.exe	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
File opened for modification	C:\Windows\SysWOW64\dqiscqvrjijpn.exe	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	uxcivcsnll.exe
File opened for modification	C:\Windows\SysWOW64\uxcivcsnll.exe	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
File created	C:\Windows\SysWOW64\qkbergnevpaqxbw.exe	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
File created	C:\Windows\SysWOW64\uxcivcsnll.exe	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
File created	C:\Windows\SysWOW64\xseqmwte.exe	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe

Drops file in Program Files directory 14 IoCs

Processes:

xseqmwte.exexseqmwte.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	xseqmwte.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	xseqmwte.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	xseqmwte.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	xseqmwte.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	xseqmwte.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	xseqmwte.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	xseqmwte.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	xseqmwte.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	xseqmwte.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	xseqmwte.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	xseqmwte.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	xseqmwte.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	xseqmwte.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	xseqmwte.exe

Drops file in Windows directory 5 IoCs

Processes:

WINWORD.EXE3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

uxcivcsnll.exeWINWORD.EXE3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	uxcivcsnll.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BB4FABFF916F1E5840B3B4686EE3994B389038D43690238E2BD429B09D4"	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	uxcivcsnll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	uxcivcsnll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32462D0B9C5183566D4376D377252CA97D8264AC"	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193DC60C15E3DBB1B8BD7CE8ED9537B9"	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	uxcivcsnll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	uxcivcsnll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	uxcivcsnll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	uxcivcsnll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

808 WINWORD.EXE

pid	process
808	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exeuxcivcsnll.exexseqmwte.exeqkbergnevpaqxbw.exedqiscqvrjijpn.exexseqmwte.exe

pid	process
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1620	uxcivcsnll.exe
1620	uxcivcsnll.exe
1620	uxcivcsnll.exe
1620	uxcivcsnll.exe
1620	uxcivcsnll.exe
1576	xseqmwte.exe
1576	xseqmwte.exe
1576	xseqmwte.exe
1576	xseqmwte.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1884	xseqmwte.exe
1884	xseqmwte.exe
1884	xseqmwte.exe
1884	xseqmwte.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exeuxcivcsnll.exexseqmwte.exeqkbergnevpaqxbw.exedqiscqvrjijpn.exexseqmwte.exe

pid	process
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1620	uxcivcsnll.exe
1620	uxcivcsnll.exe
1620	uxcivcsnll.exe
1576	xseqmwte.exe
1576	xseqmwte.exe
1576	xseqmwte.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1884	xseqmwte.exe
1884	xseqmwte.exe
1884	xseqmwte.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exeuxcivcsnll.exexseqmwte.exeqkbergnevpaqxbw.exedqiscqvrjijpn.exexseqmwte.exe

pid	process
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
1620	uxcivcsnll.exe
1620	uxcivcsnll.exe
1620	uxcivcsnll.exe
1576	xseqmwte.exe
1576	xseqmwte.exe
1576	xseqmwte.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1696	qkbergnevpaqxbw.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1404	dqiscqvrjijpn.exe
1884	xseqmwte.exe
1884	xseqmwte.exe
1884	xseqmwte.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

808 WINWORD.EXE
808 WINWORD.EXE

pid	process
808	WINWORD.EXE
808	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exeuxcivcsnll.exeWINWORD.EXE

description	pid	process	target process
PID 1044 wrote to memory of 1620	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	uxcivcsnll.exe
PID 1044 wrote to memory of 1620	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	uxcivcsnll.exe
PID 1044 wrote to memory of 1620	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	uxcivcsnll.exe
PID 1044 wrote to memory of 1620	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	uxcivcsnll.exe
PID 1044 wrote to memory of 1696	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	qkbergnevpaqxbw.exe
PID 1044 wrote to memory of 1696	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	qkbergnevpaqxbw.exe
PID 1044 wrote to memory of 1696	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	qkbergnevpaqxbw.exe
PID 1044 wrote to memory of 1696	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	qkbergnevpaqxbw.exe
PID 1044 wrote to memory of 1576	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	xseqmwte.exe
PID 1044 wrote to memory of 1576	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	xseqmwte.exe
PID 1044 wrote to memory of 1576	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	xseqmwte.exe
PID 1044 wrote to memory of 1576	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	xseqmwte.exe
PID 1044 wrote to memory of 1404	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	dqiscqvrjijpn.exe
PID 1044 wrote to memory of 1404	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	dqiscqvrjijpn.exe
PID 1044 wrote to memory of 1404	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	dqiscqvrjijpn.exe
PID 1044 wrote to memory of 1404	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	dqiscqvrjijpn.exe
PID 1620 wrote to memory of 1884	1620	uxcivcsnll.exe	xseqmwte.exe
PID 1620 wrote to memory of 1884	1620	uxcivcsnll.exe	xseqmwte.exe
PID 1620 wrote to memory of 1884	1620	uxcivcsnll.exe	xseqmwte.exe
PID 1620 wrote to memory of 1884	1620	uxcivcsnll.exe	xseqmwte.exe
PID 1044 wrote to memory of 808	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	WINWORD.EXE
PID 1044 wrote to memory of 808	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	WINWORD.EXE
PID 1044 wrote to memory of 808	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	WINWORD.EXE
PID 1044 wrote to memory of 808	1044	3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe	WINWORD.EXE
PID 808 wrote to memory of 1628	808	WINWORD.EXE	splwow64.exe
PID 808 wrote to memory of 1628	808	WINWORD.EXE	splwow64.exe
PID 808 wrote to memory of 1628	808	WINWORD.EXE	splwow64.exe
PID 808 wrote to memory of 1628	808	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe
"C:\Users\Admin\AppData\Local\Temp\3e34575311d751dd5c409ce1bc5b694ec03b9b776fcee7bc69df16c88fa30b41.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\uxcivcsnll.exe
uxcivcsnll.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\xseqmwte.exe
C:\Windows\system32\xseqmwte.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1884

C:\Windows\SysWOW64\qkbergnevpaqxbw.exe
qkbergnevpaqxbw.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1696

C:\Windows\SysWOW64\xseqmwte.exe
xseqmwte.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1576

C:\Windows\SysWOW64\dqiscqvrjijpn.exe
dqiscqvrjijpn.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1404

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:1628

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
Filesize
255KB

MD5
13cdc7b39cda88e52cd493e070f8afe8

SHA1
d667cb368a472978854a738663d9a059e92187aa

SHA256
ad0ca47ce6bf1afce8912a62630c2821fccf9be6b5d6fcba616ba971a04ac7ce

SHA512
cf793e8688bd524a99f371a18e0e9eaa4201045d5e5882f18a6cb35204ee3e0d6cd6470875a0e9b86534838ce8710e5dbd69300a54826f55107a24bb7bb81138

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
Filesize
255KB

MD5
d1a6afe0370550c4e33ad481041c1fed

SHA1
c148bd73ce70744a5593075d93875d9a098dd50f

SHA256
8093bd54e1ab5187d0c7f77fdc13a868e34aac5b14d5856ed6a414b44ccd1560

SHA512
eab57f42eec981f62f73865d8c651ca0e384bee1c69eb4cbd352adc9e1312b3ff4f69490e6ca2883c009fa8b58fb63dcd59b5ee257d711680e3c78b460fd6e0e

Download Submit
C:\Users\Admin\AppData\Roaming\CompleteApprove.doc.exe
Filesize
255KB

MD5
625616f19d431a99e3a7420d08eb5aab

SHA1
671c441ff89e45068ed693942f024b868a09460a

SHA256
ab9b932a60b57c54ae9cbb79fab1f45f979a0d73985ef1eeb764f0312e1f3717

SHA512
ba3c30b1cfca546d0502314e8b7947cd3e4d1e583595377727ae8c2d0828db5c46771ad5696718a6a2ed7f4647f52d5e36364e47b5d8b90397bec244a48688c7

Download Submit
C:\Windows\SysWOW64\dqiscqvrjijpn.exe
Filesize
255KB

MD5
dbfb0341abfb64d5996d79c93e17456a

SHA1
cd2118197377176e5c547df50edb807324591e6e

SHA256
a27ec3fd6e550b4afee89b2172e16f90af5570a8ee5c8946c60bab4f633ae2c7

SHA512
0f738ead042083c44228f23994e818b1f07ad15b405fb89284ea13c43a6daad1859e66e932fcea6b1f023f0cf104eaaaaa974104343a419abbd7a59df32a05b4

Download Submit
C:\Windows\SysWOW64\dqiscqvrjijpn.exe
Filesize
255KB

MD5
dbfb0341abfb64d5996d79c93e17456a

SHA1
cd2118197377176e5c547df50edb807324591e6e

SHA256
a27ec3fd6e550b4afee89b2172e16f90af5570a8ee5c8946c60bab4f633ae2c7

SHA512
0f738ead042083c44228f23994e818b1f07ad15b405fb89284ea13c43a6daad1859e66e932fcea6b1f023f0cf104eaaaaa974104343a419abbd7a59df32a05b4

Download Submit
C:\Windows\SysWOW64\qkbergnevpaqxbw.exe
Filesize
255KB

MD5
b9aa875907d33a9d6df04f4ea441c892

SHA1
b155dba5aca0e60f11c9a3d6529e16409bee5f16

SHA256
c86e6a280689c7d04eda2e6d3709da18227b50cacd261f35236044d55672db3d

SHA512
a5a4b51f85960acf697ab1a293afcad4b93b5cd0000143b042bf94551d558fab5cd6041ffd6bc2dc6da91daa386dff054a1a9f284ff7d1de5cb5d784b76fc0de

Download Submit
C:\Windows\SysWOW64\qkbergnevpaqxbw.exe
Filesize
255KB

MD5
b9aa875907d33a9d6df04f4ea441c892

SHA1
b155dba5aca0e60f11c9a3d6529e16409bee5f16

SHA256
c86e6a280689c7d04eda2e6d3709da18227b50cacd261f35236044d55672db3d

SHA512
a5a4b51f85960acf697ab1a293afcad4b93b5cd0000143b042bf94551d558fab5cd6041ffd6bc2dc6da91daa386dff054a1a9f284ff7d1de5cb5d784b76fc0de

Download Submit
C:\Windows\SysWOW64\uxcivcsnll.exe
Filesize
255KB

MD5
bf6d249c0cbcdbafbe017faba5d1cac8

SHA1
259295a6e6ab0b562768662d226bde8a87ebcea8

SHA256
99332ebfbe5df3d89eb33958c106035a2a25690e7f0089a41ba3da33bc4d0df7

SHA512
08d89c87e84f61dbe94570e5c28f611f949c13062b88beacc1a28e4ea98fd7ec7eb3f8b5674367a96e0153435a17e1d9d3b217e9fcf98c4d9edcf24f9ded98f4

Download Submit
C:\Windows\SysWOW64\uxcivcsnll.exe
Filesize
255KB

MD5
bf6d249c0cbcdbafbe017faba5d1cac8

SHA1
259295a6e6ab0b562768662d226bde8a87ebcea8

SHA256
99332ebfbe5df3d89eb33958c106035a2a25690e7f0089a41ba3da33bc4d0df7

SHA512
08d89c87e84f61dbe94570e5c28f611f949c13062b88beacc1a28e4ea98fd7ec7eb3f8b5674367a96e0153435a17e1d9d3b217e9fcf98c4d9edcf24f9ded98f4

Download Submit
C:\Windows\SysWOW64\xseqmwte.exe
Filesize
255KB

MD5
fc6645edabafb9514930cd1ed20a47c4

SHA1
4682255ba669ae607f21966dd1986f5f5694a38c

SHA256
131f1feca81e4686ce263bb50542ac5744c84f80df45f96865c2b4c7b3031633

SHA512
bc9aeca322c3526950ad20b148fd3dec73394b2745f218c8bb8b4da7301dfb43fd30c8c1e8ad7ca38eb03f96b406d8bdc4d71520609fbe2bea02428ad77ded30

Download Submit
C:\Windows\SysWOW64\xseqmwte.exe
Filesize
255KB

MD5
fc6645edabafb9514930cd1ed20a47c4

SHA1
4682255ba669ae607f21966dd1986f5f5694a38c

SHA256
131f1feca81e4686ce263bb50542ac5744c84f80df45f96865c2b4c7b3031633

SHA512
bc9aeca322c3526950ad20b148fd3dec73394b2745f218c8bb8b4da7301dfb43fd30c8c1e8ad7ca38eb03f96b406d8bdc4d71520609fbe2bea02428ad77ded30

Download Submit
C:\Windows\SysWOW64\xseqmwte.exe
Filesize
255KB

MD5
fc6645edabafb9514930cd1ed20a47c4

SHA1
4682255ba669ae607f21966dd1986f5f5694a38c

SHA256
131f1feca81e4686ce263bb50542ac5744c84f80df45f96865c2b4c7b3031633

SHA512
bc9aeca322c3526950ad20b148fd3dec73394b2745f218c8bb8b4da7301dfb43fd30c8c1e8ad7ca38eb03f96b406d8bdc4d71520609fbe2bea02428ad77ded30

Download Submit
C:\Windows\mydoc.rtf
Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\dqiscqvrjijpn.exe
Filesize
255KB

MD5
dbfb0341abfb64d5996d79c93e17456a

SHA1
cd2118197377176e5c547df50edb807324591e6e

SHA256
a27ec3fd6e550b4afee89b2172e16f90af5570a8ee5c8946c60bab4f633ae2c7

SHA512
0f738ead042083c44228f23994e818b1f07ad15b405fb89284ea13c43a6daad1859e66e932fcea6b1f023f0cf104eaaaaa974104343a419abbd7a59df32a05b4

Download Submit
\Windows\SysWOW64\qkbergnevpaqxbw.exe
Filesize
255KB

MD5
b9aa875907d33a9d6df04f4ea441c892

SHA1
b155dba5aca0e60f11c9a3d6529e16409bee5f16

SHA256
c86e6a280689c7d04eda2e6d3709da18227b50cacd261f35236044d55672db3d

SHA512
a5a4b51f85960acf697ab1a293afcad4b93b5cd0000143b042bf94551d558fab5cd6041ffd6bc2dc6da91daa386dff054a1a9f284ff7d1de5cb5d784b76fc0de

Download Submit
\Windows\SysWOW64\uxcivcsnll.exe
Filesize
255KB

MD5
bf6d249c0cbcdbafbe017faba5d1cac8

SHA1
259295a6e6ab0b562768662d226bde8a87ebcea8

SHA256
99332ebfbe5df3d89eb33958c106035a2a25690e7f0089a41ba3da33bc4d0df7

SHA512
08d89c87e84f61dbe94570e5c28f611f949c13062b88beacc1a28e4ea98fd7ec7eb3f8b5674367a96e0153435a17e1d9d3b217e9fcf98c4d9edcf24f9ded98f4

Download Submit
\Windows\SysWOW64\xseqmwte.exe
Filesize
255KB

MD5
fc6645edabafb9514930cd1ed20a47c4

SHA1
4682255ba669ae607f21966dd1986f5f5694a38c

SHA256
131f1feca81e4686ce263bb50542ac5744c84f80df45f96865c2b4c7b3031633

SHA512
bc9aeca322c3526950ad20b148fd3dec73394b2745f218c8bb8b4da7301dfb43fd30c8c1e8ad7ca38eb03f96b406d8bdc4d71520609fbe2bea02428ad77ded30

Download Submit
\Windows\SysWOW64\xseqmwte.exe
Filesize
255KB

MD5
fc6645edabafb9514930cd1ed20a47c4

SHA1
4682255ba669ae607f21966dd1986f5f5694a38c

SHA256
131f1feca81e4686ce263bb50542ac5744c84f80df45f96865c2b4c7b3031633

SHA512
bc9aeca322c3526950ad20b148fd3dec73394b2745f218c8bb8b4da7301dfb43fd30c8c1e8ad7ca38eb03f96b406d8bdc4d71520609fbe2bea02428ad77ded30

Download Submit
memory/808-86-0x0000000000000000-mapping.dmp

Download
memory/808-100-0x00000000710DD000-0x00000000710E8000-memory.dmp

Filesize
44KB

Download
memory/808-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/808-94-0x00000000710DD000-0x00000000710E8000-memory.dmp

Filesize
44KB

Download
memory/808-91-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/808-107-0x00000000710DD000-0x00000000710E8000-memory.dmp

Filesize
44KB

Download
memory/808-89-0x00000000700F1000-0x00000000700F3000-memory.dmp

Filesize
8KB

Download
memory/808-88-0x0000000072671000-0x0000000072674000-memory.dmp

Filesize
12KB

Download
memory/1044-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/1044-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1044-76-0x00000000033B0000-0x0000000003450000-memory.dmp

Filesize
640KB

Download
memory/1044-80-0x00000000033B0000-0x0000000003450000-memory.dmp

Filesize
640KB

Download
memory/1044-75-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1404-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1404-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1404-70-0x0000000000000000-mapping.dmp

Download
memory/1576-63-0x0000000000000000-mapping.dmp

Download
memory/1576-78-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1576-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1620-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1620-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1620-56-0x0000000000000000-mapping.dmp

Download
memory/1628-105-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download
memory/1628-104-0x0000000000000000-mapping.dmp

Download
memory/1696-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1696-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1696-60-0x0000000000000000-mapping.dmp

Download
memory/1884-83-0x0000000000000000-mapping.dmp

Download
memory/1884-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1884-90-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads