6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743

Analysis

max time kernel
151s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
Size

255KB
MD5

274110737585bd5300cdbe2b64361de1
SHA1

c9b9baa87260a23197a98c4b108272675a0cba1d
SHA256

6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743
SHA512

020879b5da21669e5513e097b94880a6f1d70b7debcbae55f98bc54f56510f46b59dfa76e5a47d9b61e2e026a4bff1e2d3bfedbe0ad3644f31ba213587652a1c
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ8:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI5

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

nfpwtymgww.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	nfpwtymgww.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

nfpwtymgww.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nfpwtymgww.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

nfpwtymgww.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nfpwtymgww.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

nfpwtymgww.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	nfpwtymgww.exe

Executes dropped EXE 5 IoCs

Processes:

nfpwtymgww.exeblgbughvghcuvkb.exeifbrygvn.exejdhafdgslsrop.exeifbrygvn.exe

pid process

1448 nfpwtymgww.exe
1348 blgbughvghcuvkb.exe
676 ifbrygvn.exe
680 jdhafdgslsrop.exe
920 ifbrygvn.exe

pid	process
1448	nfpwtymgww.exe
1348	blgbughvghcuvkb.exe
676	ifbrygvn.exe
680	jdhafdgslsrop.exe
920	ifbrygvn.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1444-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\nfpwtymgww.exe	upx
\Windows\SysWOW64\blgbughvghcuvkb.exe	upx
C:\Windows\SysWOW64\nfpwtymgww.exe	upx
C:\Windows\SysWOW64\blgbughvghcuvkb.exe	upx
C:\Windows\SysWOW64\nfpwtymgww.exe	upx
\Windows\SysWOW64\ifbrygvn.exe	upx
C:\Windows\SysWOW64\ifbrygvn.exe	upx
C:\Windows\SysWOW64\blgbughvghcuvkb.exe	upx
\Windows\SysWOW64\jdhafdgslsrop.exe	upx
C:\Windows\SysWOW64\ifbrygvn.exe	upx
C:\Windows\SysWOW64\jdhafdgslsrop.exe	upx
C:\Windows\SysWOW64\jdhafdgslsrop.exe	upx
behavioral1/memory/1448-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1348-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/676-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/680-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\ifbrygvn.exe	upx
C:\Windows\SysWOW64\ifbrygvn.exe	upx
behavioral1/memory/1444-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/920-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1448-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1348-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/676-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/680-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/920-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\UnlockCompare.doc.exe	upx
C:\Users\Admin\Desktop\WatchClose.doc.exe	upx
C:\Users\Admin\Desktop\WatchClose.doc.exe	upx

Loads dropped DLL 5 IoCs

Processes:

6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exenfpwtymgww.exe

pid	process
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1448	nfpwtymgww.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

nfpwtymgww.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	nfpwtymgww.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

blgbughvghcuvkb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jdhafdgslsrop.exe"	blgbughvghcuvkb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	blgbughvghcuvkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\caqfpgau = "nfpwtymgww.exe"	blgbughvghcuvkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\xvmryxzp = "blgbughvghcuvkb.exe"	blgbughvghcuvkb.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ifbrygvn.exenfpwtymgww.exeifbrygvn.exe

description	ioc	process
File opened (read-only)	\??\a:	ifbrygvn.exe
File opened (read-only)	\??\x:	ifbrygvn.exe
File opened (read-only)	\??\q:	nfpwtymgww.exe
File opened (read-only)	\??\u:	nfpwtymgww.exe
File opened (read-only)	\??\v:	nfpwtymgww.exe
File opened (read-only)	\??\l:	ifbrygvn.exe
File opened (read-only)	\??\i:	nfpwtymgww.exe
File opened (read-only)	\??\x:	nfpwtymgww.exe
File opened (read-only)	\??\e:	ifbrygvn.exe
File opened (read-only)	\??\h:	ifbrygvn.exe
File opened (read-only)	\??\m:	ifbrygvn.exe
File opened (read-only)	\??\k:	ifbrygvn.exe
File opened (read-only)	\??\r:	ifbrygvn.exe
File opened (read-only)	\??\u:	ifbrygvn.exe
File opened (read-only)	\??\e:	ifbrygvn.exe
File opened (read-only)	\??\j:	ifbrygvn.exe
File opened (read-only)	\??\s:	ifbrygvn.exe
File opened (read-only)	\??\e:	nfpwtymgww.exe
File opened (read-only)	\??\k:	nfpwtymgww.exe
File opened (read-only)	\??\i:	ifbrygvn.exe
File opened (read-only)	\??\i:	ifbrygvn.exe
File opened (read-only)	\??\k:	ifbrygvn.exe
File opened (read-only)	\??\a:	nfpwtymgww.exe
File opened (read-only)	\??\g:	ifbrygvn.exe
File opened (read-only)	\??\p:	ifbrygvn.exe
File opened (read-only)	\??\y:	nfpwtymgww.exe
File opened (read-only)	\??\y:	ifbrygvn.exe
File opened (read-only)	\??\h:	nfpwtymgww.exe
File opened (read-only)	\??\t:	nfpwtymgww.exe
File opened (read-only)	\??\z:	nfpwtymgww.exe
File opened (read-only)	\??\f:	ifbrygvn.exe
File opened (read-only)	\??\a:	ifbrygvn.exe
File opened (read-only)	\??\p:	ifbrygvn.exe
File opened (read-only)	\??\q:	ifbrygvn.exe
File opened (read-only)	\??\q:	ifbrygvn.exe
File opened (read-only)	\??\r:	ifbrygvn.exe
File opened (read-only)	\??\z:	ifbrygvn.exe
File opened (read-only)	\??\g:	nfpwtymgww.exe
File opened (read-only)	\??\j:	nfpwtymgww.exe
File opened (read-only)	\??\n:	ifbrygvn.exe
File opened (read-only)	\??\w:	ifbrygvn.exe
File opened (read-only)	\??\r:	nfpwtymgww.exe
File opened (read-only)	\??\o:	ifbrygvn.exe
File opened (read-only)	\??\n:	ifbrygvn.exe
File opened (read-only)	\??\l:	nfpwtymgww.exe
File opened (read-only)	\??\b:	ifbrygvn.exe
File opened (read-only)	\??\h:	ifbrygvn.exe
File opened (read-only)	\??\j:	ifbrygvn.exe
File opened (read-only)	\??\v:	ifbrygvn.exe
File opened (read-only)	\??\b:	nfpwtymgww.exe
File opened (read-only)	\??\p:	nfpwtymgww.exe
File opened (read-only)	\??\g:	ifbrygvn.exe
File opened (read-only)	\??\w:	ifbrygvn.exe
File opened (read-only)	\??\o:	nfpwtymgww.exe
File opened (read-only)	\??\x:	ifbrygvn.exe
File opened (read-only)	\??\f:	ifbrygvn.exe
File opened (read-only)	\??\b:	ifbrygvn.exe
File opened (read-only)	\??\l:	ifbrygvn.exe
File opened (read-only)	\??\t:	ifbrygvn.exe
File opened (read-only)	\??\f:	nfpwtymgww.exe
File opened (read-only)	\??\s:	nfpwtymgww.exe
File opened (read-only)	\??\w:	nfpwtymgww.exe
File opened (read-only)	\??\o:	ifbrygvn.exe
File opened (read-only)	\??\u:	ifbrygvn.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

nfpwtymgww.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	nfpwtymgww.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	nfpwtymgww.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1448-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1348-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1444-80-0x0000000002320000-0x00000000023C0000-memory.dmp	autoit_exe
behavioral1/memory/676-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/680-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1444-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/920-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1448-91-0x0000000003840000-0x00000000038E0000-memory.dmp	autoit_exe
behavioral1/memory/1448-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1348-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/676-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/680-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1448-98-0x0000000003840000-0x00000000038E0000-memory.dmp	autoit_exe
behavioral1/memory/920-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exenfpwtymgww.exe

description	ioc	process
File created	C:\Windows\SysWOW64\blgbughvghcuvkb.exe	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
File opened for modification	C:\Windows\SysWOW64\blgbughvghcuvkb.exe	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
File created	C:\Windows\SysWOW64\ifbrygvn.exe	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
File opened for modification	C:\Windows\SysWOW64\ifbrygvn.exe	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	nfpwtymgww.exe
File created	C:\Windows\SysWOW64\nfpwtymgww.exe	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
File created	C:\Windows\SysWOW64\jdhafdgslsrop.exe	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
File opened for modification	C:\Windows\SysWOW64\jdhafdgslsrop.exe	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
File opened for modification	C:\Windows\SysWOW64\nfpwtymgww.exe	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe

Drops file in Program Files directory 14 IoCs

Processes:

ifbrygvn.exeifbrygvn.exe

description	ioc	process
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ifbrygvn.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ifbrygvn.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	ifbrygvn.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ifbrygvn.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	ifbrygvn.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	ifbrygvn.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ifbrygvn.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	ifbrygvn.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ifbrygvn.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ifbrygvn.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ifbrygvn.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ifbrygvn.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ifbrygvn.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ifbrygvn.exe

Drops file in Windows directory 5 IoCs

Processes:

6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEnfpwtymgww.exe6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	nfpwtymgww.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	nfpwtymgww.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	nfpwtymgww.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	nfpwtymgww.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	nfpwtymgww.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACEFAB8F96AF1E084753B4686EC3E97B08802FC4312023CE2C842EB08A8"	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	nfpwtymgww.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	nfpwtymgww.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1080 WINWORD.EXE

pid	process
1080	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exenfpwtymgww.exeblgbughvghcuvkb.exeifbrygvn.exejdhafdgslsrop.exeifbrygvn.exe

pid	process
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1448	nfpwtymgww.exe
1448	nfpwtymgww.exe
1448	nfpwtymgww.exe
1448	nfpwtymgww.exe
1448	nfpwtymgww.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
676	ifbrygvn.exe
676	ifbrygvn.exe
676	ifbrygvn.exe
676	ifbrygvn.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
920	ifbrygvn.exe
920	ifbrygvn.exe
920	ifbrygvn.exe
920	ifbrygvn.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
1348	blgbughvghcuvkb.exe
680	jdhafdgslsrop.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exenfpwtymgww.exeblgbughvghcuvkb.exeifbrygvn.exejdhafdgslsrop.exeifbrygvn.exe

pid	process
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1448	nfpwtymgww.exe
1448	nfpwtymgww.exe
1448	nfpwtymgww.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
676	ifbrygvn.exe
676	ifbrygvn.exe
676	ifbrygvn.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
920	ifbrygvn.exe
920	ifbrygvn.exe
920	ifbrygvn.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exenfpwtymgww.exeblgbughvghcuvkb.exeifbrygvn.exejdhafdgslsrop.exeifbrygvn.exe

pid	process
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
1448	nfpwtymgww.exe
1448	nfpwtymgww.exe
1448	nfpwtymgww.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
1348	blgbughvghcuvkb.exe
676	ifbrygvn.exe
676	ifbrygvn.exe
676	ifbrygvn.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
680	jdhafdgslsrop.exe
920	ifbrygvn.exe
920	ifbrygvn.exe
920	ifbrygvn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1080 WINWORD.EXE
1080 WINWORD.EXE

pid	process
1080	WINWORD.EXE
1080	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exenfpwtymgww.exeWINWORD.EXE

description	pid	process	target process
PID 1444 wrote to memory of 1448	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	nfpwtymgww.exe
PID 1444 wrote to memory of 1448	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	nfpwtymgww.exe
PID 1444 wrote to memory of 1448	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	nfpwtymgww.exe
PID 1444 wrote to memory of 1448	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	nfpwtymgww.exe
PID 1444 wrote to memory of 1348	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	blgbughvghcuvkb.exe
PID 1444 wrote to memory of 1348	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	blgbughvghcuvkb.exe
PID 1444 wrote to memory of 1348	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	blgbughvghcuvkb.exe
PID 1444 wrote to memory of 1348	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	blgbughvghcuvkb.exe
PID 1444 wrote to memory of 676	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	ifbrygvn.exe
PID 1444 wrote to memory of 676	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	ifbrygvn.exe
PID 1444 wrote to memory of 676	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	ifbrygvn.exe
PID 1444 wrote to memory of 676	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	ifbrygvn.exe
PID 1444 wrote to memory of 680	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	jdhafdgslsrop.exe
PID 1444 wrote to memory of 680	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	jdhafdgslsrop.exe
PID 1444 wrote to memory of 680	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	jdhafdgslsrop.exe
PID 1444 wrote to memory of 680	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	jdhafdgslsrop.exe
PID 1448 wrote to memory of 920	1448	nfpwtymgww.exe	ifbrygvn.exe
PID 1448 wrote to memory of 920	1448	nfpwtymgww.exe	ifbrygvn.exe
PID 1448 wrote to memory of 920	1448	nfpwtymgww.exe	ifbrygvn.exe
PID 1448 wrote to memory of 920	1448	nfpwtymgww.exe	ifbrygvn.exe
PID 1444 wrote to memory of 1080	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	WINWORD.EXE
PID 1444 wrote to memory of 1080	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	WINWORD.EXE
PID 1444 wrote to memory of 1080	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	WINWORD.EXE
PID 1444 wrote to memory of 1080	1444	6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe	WINWORD.EXE
PID 1080 wrote to memory of 1584	1080	WINWORD.EXE	splwow64.exe
PID 1080 wrote to memory of 1584	1080	WINWORD.EXE	splwow64.exe
PID 1080 wrote to memory of 1584	1080	WINWORD.EXE	splwow64.exe
PID 1080 wrote to memory of 1584	1080	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe
"C:\Users\Admin\AppData\Local\Temp\6a2bef16e94b21793b461a1a87774dc0c647cbe561e029b4bc3bc0a8a7189743.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\SysWOW64\nfpwtymgww.exe
nfpwtymgww.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\ifbrygvn.exe
C:\Windows\system32\ifbrygvn.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:920

C:\Windows\SysWOW64\blgbughvghcuvkb.exe
blgbughvghcuvkb.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1348

C:\Windows\SysWOW64\ifbrygvn.exe
ifbrygvn.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:676

C:\Windows\SysWOW64\jdhafdgslsrop.exe
jdhafdgslsrop.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:680

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\UnlockCompare.doc.exe

Filesize
255KB

MD5
0e521f3da5de68fa095dd35906865016

SHA1
c8f3ea90b1679627e01c8656aac75441612d388b

SHA256
590f650bf419710710c060f37f653354463bfeb33487c2ed8df82ca0c6ae20d5

SHA512
7bec14ac73af973d7522f8bfe851b2e3a03f2daac927eec4c2e5386dfb8e06acf59e1434173ab3ec5c3a982055ac89706aee0c33fe98e2cfd85f821ff76a5e8b

Download Submit
C:\Users\Admin\Desktop\WatchClose.doc.exe

Filesize
255KB

MD5
be289d50b44dcf407336daa0cd39e2ed

SHA1
e14e994f5823541a1aab67d9e6226ebc4c58bb44

SHA256
858656dfb1c7ee5959d95f14a1b20b1cb335b0712ac2411e1b5e23541228c5ca

SHA512
185742cd074a5c49c0e3a42a42464dd8229c4144d9dc1ea61138a9c24482ff853615c2d685bcadafe9581fd2cea88005097c84f8549a71628433f3fcdddee77e

Download Submit
C:\Users\Admin\Desktop\WatchClose.doc.exe

Filesize
255KB

MD5
be289d50b44dcf407336daa0cd39e2ed

SHA1
e14e994f5823541a1aab67d9e6226ebc4c58bb44

SHA256
858656dfb1c7ee5959d95f14a1b20b1cb335b0712ac2411e1b5e23541228c5ca

SHA512
185742cd074a5c49c0e3a42a42464dd8229c4144d9dc1ea61138a9c24482ff853615c2d685bcadafe9581fd2cea88005097c84f8549a71628433f3fcdddee77e

Download Submit
C:\Windows\SysWOW64\blgbughvghcuvkb.exe

Filesize
255KB

MD5
3768cf8fc6f7a8be40df805a283f7444

SHA1
b48afb1c25f3ca2ea4fb28e9201cc7f912531216

SHA256
a5cffb96e8a78885f020dd597c48fd0c3b19ed690bf849fdec04a418223a126d

SHA512
9363a7ec09f5c4adc410b051ff5d821d42882c52ecab877be1b8d093a03a3697a0d01362325907d25077cd232f20669d180c0abf83cd921f778776fea5825589

Download Submit
C:\Windows\SysWOW64\blgbughvghcuvkb.exe

Filesize
255KB

MD5
3768cf8fc6f7a8be40df805a283f7444

SHA1
b48afb1c25f3ca2ea4fb28e9201cc7f912531216

SHA256
a5cffb96e8a78885f020dd597c48fd0c3b19ed690bf849fdec04a418223a126d

SHA512
9363a7ec09f5c4adc410b051ff5d821d42882c52ecab877be1b8d093a03a3697a0d01362325907d25077cd232f20669d180c0abf83cd921f778776fea5825589

Download Submit
C:\Windows\SysWOW64\ifbrygvn.exe

Filesize
255KB

MD5
6f4f90b12de43b441e7dc8096ac45223

SHA1
04d03ccc4c2a9f3c4d5495720d9bf20532ea6e1d

SHA256
2aa50b2df82aa45680508a597b0e1f34ea247bc09beac113e7fbeac91b3aad62

SHA512
766d7a5f80875200481170c701210845dc53805af7211935df174ed63b1da25cc8838e66e8a7259b0a913d1485bc90138ca4870a8df104baa989c43dd3184162

Download Submit
C:\Windows\SysWOW64\ifbrygvn.exe

Filesize
255KB

MD5
6f4f90b12de43b441e7dc8096ac45223

SHA1
04d03ccc4c2a9f3c4d5495720d9bf20532ea6e1d

SHA256
2aa50b2df82aa45680508a597b0e1f34ea247bc09beac113e7fbeac91b3aad62

SHA512
766d7a5f80875200481170c701210845dc53805af7211935df174ed63b1da25cc8838e66e8a7259b0a913d1485bc90138ca4870a8df104baa989c43dd3184162

Download Submit
C:\Windows\SysWOW64\ifbrygvn.exe

Filesize
255KB

MD5
6f4f90b12de43b441e7dc8096ac45223

SHA1
04d03ccc4c2a9f3c4d5495720d9bf20532ea6e1d

SHA256
2aa50b2df82aa45680508a597b0e1f34ea247bc09beac113e7fbeac91b3aad62

SHA512
766d7a5f80875200481170c701210845dc53805af7211935df174ed63b1da25cc8838e66e8a7259b0a913d1485bc90138ca4870a8df104baa989c43dd3184162

Download Submit
C:\Windows\SysWOW64\jdhafdgslsrop.exe

Filesize
255KB

MD5
acf5edfdfa85bddecd5bfd98f332c443

SHA1
851bba6ab305fc2a6aae4827dc6fc4fb16067f41

SHA256
2030aff4ff5a108abeb23fbe1152fa9f0a2d1a9c7e935746faebb31e5dd7c02b

SHA512
c361e62dc0d550f784f530676d9cbe9bcb0a9c76d97c6616a2232b610ca392578bfb97e8bb98dc214c1cf7fe62b6f04cb638e44934c1c9d2bedd2861f4291bef

Download Submit
C:\Windows\SysWOW64\jdhafdgslsrop.exe

Filesize
255KB

MD5
acf5edfdfa85bddecd5bfd98f332c443

SHA1
851bba6ab305fc2a6aae4827dc6fc4fb16067f41

SHA256
2030aff4ff5a108abeb23fbe1152fa9f0a2d1a9c7e935746faebb31e5dd7c02b

SHA512
c361e62dc0d550f784f530676d9cbe9bcb0a9c76d97c6616a2232b610ca392578bfb97e8bb98dc214c1cf7fe62b6f04cb638e44934c1c9d2bedd2861f4291bef

Download Submit
C:\Windows\SysWOW64\nfpwtymgww.exe

Filesize
255KB

MD5
3d0cf027b4253e6a810b6aeb6eb95e92

SHA1
da63816162a076442f228c4b2d68cd0094024e3a

SHA256
b83d61d4ede1ee246df906efd523cc593a8b7dbe9b1763c7035fcf99ae84594a

SHA512
152d8b6eb85fe14101735b2d7a58ab410535d46c78888db5b068542f81a8eb34f1ebb81f24778fc337ea4ebf59a30f8ac8c974b59c3ef4ea52f9c3c42b934e6a

Download Submit
C:\Windows\SysWOW64\nfpwtymgww.exe

Filesize
255KB

MD5
3d0cf027b4253e6a810b6aeb6eb95e92

SHA1
da63816162a076442f228c4b2d68cd0094024e3a

SHA256
b83d61d4ede1ee246df906efd523cc593a8b7dbe9b1763c7035fcf99ae84594a

SHA512
152d8b6eb85fe14101735b2d7a58ab410535d46c78888db5b068542f81a8eb34f1ebb81f24778fc337ea4ebf59a30f8ac8c974b59c3ef4ea52f9c3c42b934e6a

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\blgbughvghcuvkb.exe

Filesize
255KB

MD5
3768cf8fc6f7a8be40df805a283f7444

SHA1
b48afb1c25f3ca2ea4fb28e9201cc7f912531216

SHA256
a5cffb96e8a78885f020dd597c48fd0c3b19ed690bf849fdec04a418223a126d

SHA512
9363a7ec09f5c4adc410b051ff5d821d42882c52ecab877be1b8d093a03a3697a0d01362325907d25077cd232f20669d180c0abf83cd921f778776fea5825589

Download Submit
\Windows\SysWOW64\ifbrygvn.exe

Filesize
255KB

MD5
6f4f90b12de43b441e7dc8096ac45223

SHA1
04d03ccc4c2a9f3c4d5495720d9bf20532ea6e1d

SHA256
2aa50b2df82aa45680508a597b0e1f34ea247bc09beac113e7fbeac91b3aad62

SHA512
766d7a5f80875200481170c701210845dc53805af7211935df174ed63b1da25cc8838e66e8a7259b0a913d1485bc90138ca4870a8df104baa989c43dd3184162

Download Submit
\Windows\SysWOW64\ifbrygvn.exe

Filesize
255KB

MD5
6f4f90b12de43b441e7dc8096ac45223

SHA1
04d03ccc4c2a9f3c4d5495720d9bf20532ea6e1d

SHA256
2aa50b2df82aa45680508a597b0e1f34ea247bc09beac113e7fbeac91b3aad62

SHA512
766d7a5f80875200481170c701210845dc53805af7211935df174ed63b1da25cc8838e66e8a7259b0a913d1485bc90138ca4870a8df104baa989c43dd3184162

Download Submit
\Windows\SysWOW64\jdhafdgslsrop.exe

Filesize
255KB

MD5
acf5edfdfa85bddecd5bfd98f332c443

SHA1
851bba6ab305fc2a6aae4827dc6fc4fb16067f41

SHA256
2030aff4ff5a108abeb23fbe1152fa9f0a2d1a9c7e935746faebb31e5dd7c02b

SHA512
c361e62dc0d550f784f530676d9cbe9bcb0a9c76d97c6616a2232b610ca392578bfb97e8bb98dc214c1cf7fe62b6f04cb638e44934c1c9d2bedd2861f4291bef

Download Submit
\Windows\SysWOW64\nfpwtymgww.exe

Filesize
255KB

MD5
3d0cf027b4253e6a810b6aeb6eb95e92

SHA1
da63816162a076442f228c4b2d68cd0094024e3a

SHA256
b83d61d4ede1ee246df906efd523cc593a8b7dbe9b1763c7035fcf99ae84594a

SHA512
152d8b6eb85fe14101735b2d7a58ab410535d46c78888db5b068542f81a8eb34f1ebb81f24778fc337ea4ebf59a30f8ac8c974b59c3ef4ea52f9c3c42b934e6a

Download Submit
memory/676-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/676-66-0x0000000000000000-mapping.dmp

Download
memory/676-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/680-70-0x0000000000000000-mapping.dmp

Download
memory/680-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/680-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/920-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/920-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/920-84-0x0000000000000000-mapping.dmp

Download
memory/1080-103-0x000000007181D000-0x0000000071828000-memory.dmp

Filesize
44KB

Download
memory/1080-87-0x0000000000000000-mapping.dmp

Download
memory/1080-110-0x000000007181D000-0x0000000071828000-memory.dmp

Filesize
44KB

Download
memory/1080-89-0x0000000072DB1000-0x0000000072DB4000-memory.dmp

Filesize
12KB

Download
memory/1080-90-0x0000000070831000-0x0000000070833000-memory.dmp

Filesize
8KB

Download
memory/1080-92-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1080-109-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1080-101-0x000000007181D000-0x0000000071828000-memory.dmp

Filesize
44KB

Download
memory/1348-61-0x0000000000000000-mapping.dmp

Download
memory/1348-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1348-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1444-80-0x0000000002320000-0x00000000023C0000-memory.dmp

Filesize
640KB

Download
memory/1444-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/1444-78-0x0000000002320000-0x00000000023C0000-memory.dmp

Filesize
640KB

Download
memory/1444-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1444-76-0x0000000002320000-0x00000000023C0000-memory.dmp

Filesize
640KB

Download
memory/1444-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1448-98-0x0000000003840000-0x00000000038E0000-memory.dmp

Filesize
640KB

Download
memory/1448-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1448-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1448-91-0x0000000003840000-0x00000000038E0000-memory.dmp

Filesize
640KB

Download
memory/1448-57-0x0000000000000000-mapping.dmp

Download
memory/1584-107-0x0000000000000000-mapping.dmp

Download
memory/1584-108-0x000007FEFC461000-0x000007FEFC463000-memory.dmp

Filesize
8KB

Download