Analysis
-
max time kernel
156s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 05:16
Behavioral task
behavioral1
Sample
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe
Resource
win10v2004-20221111-en
General
-
Target
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe
-
Size
255KB
-
MD5
cebc22f552c64fe39370be9ce5c100be
-
SHA1
12a65f6fb09bbcc5782f12c7974b09350438cc25
-
SHA256
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f
-
SHA512
f60f0a1bc2188658a82ce4af01a638af940305d39a961ad346cbc3ed7977db6e2ce4b4185784a43c2c17fcf623d98b060a6653a8cab0f58408556b5b17f02673
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJm:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIl
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
twrjpuegzm.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" twrjpuegzm.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
twrjpuegzm.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" twrjpuegzm.exe -
Processes:
twrjpuegzm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" twrjpuegzm.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
twrjpuegzm.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" twrjpuegzm.exe -
Executes dropped EXE 5 IoCs
Processes:
twrjpuegzm.exetyrlvparnmnhdlg.exejdcbgsuv.exesvgrkzypycmba.exejdcbgsuv.exepid process 1156 twrjpuegzm.exe 1732 tyrlvparnmnhdlg.exe 1480 jdcbgsuv.exe 544 svgrkzypycmba.exe 532 jdcbgsuv.exe -
Processes:
resource yara_rule \Windows\SysWOW64\twrjpuegzm.exe upx behavioral1/memory/1648-56-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1648-57-0x0000000003340000-0x00000000033E0000-memory.dmp upx \Windows\SysWOW64\jdcbgsuv.exe upx \Windows\SysWOW64\tyrlvparnmnhdlg.exe upx C:\Windows\SysWOW64\twrjpuegzm.exe upx C:\Windows\SysWOW64\tyrlvparnmnhdlg.exe upx C:\Windows\SysWOW64\jdcbgsuv.exe upx \Windows\SysWOW64\svgrkzypycmba.exe upx C:\Windows\SysWOW64\jdcbgsuv.exe upx C:\Windows\SysWOW64\twrjpuegzm.exe upx C:\Windows\SysWOW64\tyrlvparnmnhdlg.exe upx C:\Windows\SysWOW64\svgrkzypycmba.exe upx C:\Windows\SysWOW64\svgrkzypycmba.exe upx behavioral1/memory/1156-78-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1732-80-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1480-81-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/544-82-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1648-83-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\jdcbgsuv.exe upx C:\Windows\SysWOW64\jdcbgsuv.exe upx behavioral1/memory/1648-89-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/532-92-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1156-98-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1732-99-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1480-100-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/544-101-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/532-102-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Loads dropped DLL 5 IoCs
Processes:
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exetwrjpuegzm.exepid process 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1156 twrjpuegzm.exe -
Processes:
twrjpuegzm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" twrjpuegzm.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
tyrlvparnmnhdlg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "svgrkzypycmba.exe" tyrlvparnmnhdlg.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run tyrlvparnmnhdlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ksexmzvg = "twrjpuegzm.exe" tyrlvparnmnhdlg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iiqiwfxa = "tyrlvparnmnhdlg.exe" tyrlvparnmnhdlg.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
twrjpuegzm.exejdcbgsuv.exejdcbgsuv.exedescription ioc process File opened (read-only) \??\a: twrjpuegzm.exe File opened (read-only) \??\h: twrjpuegzm.exe File opened (read-only) \??\z: twrjpuegzm.exe File opened (read-only) \??\t: jdcbgsuv.exe File opened (read-only) \??\y: jdcbgsuv.exe File opened (read-only) \??\z: jdcbgsuv.exe File opened (read-only) \??\h: jdcbgsuv.exe File opened (read-only) \??\u: jdcbgsuv.exe File opened (read-only) \??\v: jdcbgsuv.exe File opened (read-only) \??\j: twrjpuegzm.exe File opened (read-only) \??\n: twrjpuegzm.exe File opened (read-only) \??\o: jdcbgsuv.exe File opened (read-only) \??\t: jdcbgsuv.exe File opened (read-only) \??\e: twrjpuegzm.exe File opened (read-only) \??\r: twrjpuegzm.exe File opened (read-only) \??\r: jdcbgsuv.exe File opened (read-only) \??\m: jdcbgsuv.exe File opened (read-only) \??\s: twrjpuegzm.exe File opened (read-only) \??\f: jdcbgsuv.exe File opened (read-only) \??\j: jdcbgsuv.exe File opened (read-only) \??\n: jdcbgsuv.exe File opened (read-only) \??\x: jdcbgsuv.exe File opened (read-only) \??\p: twrjpuegzm.exe File opened (read-only) \??\k: jdcbgsuv.exe File opened (read-only) \??\k: twrjpuegzm.exe File opened (read-only) \??\y: twrjpuegzm.exe File opened (read-only) \??\b: jdcbgsuv.exe File opened (read-only) \??\j: jdcbgsuv.exe File opened (read-only) \??\g: twrjpuegzm.exe File opened (read-only) \??\i: jdcbgsuv.exe File opened (read-only) \??\w: jdcbgsuv.exe File opened (read-only) \??\y: jdcbgsuv.exe File opened (read-only) \??\q: twrjpuegzm.exe File opened (read-only) \??\t: twrjpuegzm.exe File opened (read-only) \??\h: jdcbgsuv.exe File opened (read-only) \??\e: jdcbgsuv.exe File opened (read-only) \??\p: jdcbgsuv.exe File opened (read-only) \??\s: jdcbgsuv.exe File opened (read-only) \??\x: jdcbgsuv.exe File opened (read-only) \??\w: twrjpuegzm.exe File opened (read-only) \??\g: jdcbgsuv.exe File opened (read-only) \??\w: jdcbgsuv.exe File opened (read-only) \??\q: jdcbgsuv.exe File opened (read-only) \??\g: jdcbgsuv.exe File opened (read-only) \??\l: jdcbgsuv.exe File opened (read-only) \??\s: jdcbgsuv.exe File opened (read-only) \??\l: twrjpuegzm.exe File opened (read-only) \??\e: jdcbgsuv.exe File opened (read-only) \??\n: jdcbgsuv.exe File opened (read-only) \??\p: jdcbgsuv.exe File opened (read-only) \??\a: jdcbgsuv.exe File opened (read-only) \??\r: jdcbgsuv.exe File opened (read-only) \??\z: jdcbgsuv.exe File opened (read-only) \??\m: twrjpuegzm.exe File opened (read-only) \??\o: twrjpuegzm.exe File opened (read-only) \??\m: jdcbgsuv.exe File opened (read-only) \??\b: jdcbgsuv.exe File opened (read-only) \??\q: jdcbgsuv.exe File opened (read-only) \??\i: twrjpuegzm.exe File opened (read-only) \??\f: jdcbgsuv.exe File opened (read-only) \??\o: jdcbgsuv.exe File opened (read-only) \??\x: twrjpuegzm.exe File opened (read-only) \??\i: jdcbgsuv.exe File opened (read-only) \??\v: jdcbgsuv.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
twrjpuegzm.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" twrjpuegzm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" twrjpuegzm.exe -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1648-56-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1156-78-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1732-80-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1480-81-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/544-82-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1648-83-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1648-89-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1156-90-0x0000000003860000-0x0000000003900000-memory.dmp autoit_exe behavioral1/memory/532-92-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1156-98-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1732-99-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1480-100-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/544-101-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/532-102-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exetwrjpuegzm.exedescription ioc process File opened for modification C:\Windows\SysWOW64\tyrlvparnmnhdlg.exe 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe File created C:\Windows\SysWOW64\jdcbgsuv.exe 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe File opened for modification C:\Windows\SysWOW64\jdcbgsuv.exe 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe File opened for modification C:\Windows\SysWOW64\svgrkzypycmba.exe 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll twrjpuegzm.exe File created C:\Windows\SysWOW64\twrjpuegzm.exe 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe File opened for modification C:\Windows\SysWOW64\twrjpuegzm.exe 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe File created C:\Windows\SysWOW64\tyrlvparnmnhdlg.exe 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe File created C:\Windows\SysWOW64\svgrkzypycmba.exe 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe -
Drops file in Windows directory 5 IoCs
Processes:
WINWORD.EXE4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exedescription ioc process File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEtwrjpuegzm.exe4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" twrjpuegzm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" twrjpuegzm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1849C67814E3DAB2B9BA7CE2EC9634C8" 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg twrjpuegzm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat twrjpuegzm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC1B12E4794399953C9B9D133E9D4B9" 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8BFCF8482782139133D62D7E9CBC94E640594467336345D7EC" 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" twrjpuegzm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 808 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exetyrlvparnmnhdlg.exejdcbgsuv.exetwrjpuegzm.exesvgrkzypycmba.exejdcbgsuv.exepid process 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1732 tyrlvparnmnhdlg.exe 1732 tyrlvparnmnhdlg.exe 1732 tyrlvparnmnhdlg.exe 1732 tyrlvparnmnhdlg.exe 1732 tyrlvparnmnhdlg.exe 1480 jdcbgsuv.exe 1480 jdcbgsuv.exe 1480 jdcbgsuv.exe 1480 jdcbgsuv.exe 1156 twrjpuegzm.exe 1156 twrjpuegzm.exe 1156 twrjpuegzm.exe 1156 twrjpuegzm.exe 1156 twrjpuegzm.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 1732 tyrlvparnmnhdlg.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 1732 tyrlvparnmnhdlg.exe 1732 tyrlvparnmnhdlg.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 532 jdcbgsuv.exe 532 jdcbgsuv.exe 532 jdcbgsuv.exe 532 jdcbgsuv.exe 1732 tyrlvparnmnhdlg.exe 544 svgrkzypycmba.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exetyrlvparnmnhdlg.exetwrjpuegzm.exejdcbgsuv.exesvgrkzypycmba.exejdcbgsuv.exepid process 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1732 tyrlvparnmnhdlg.exe 1156 twrjpuegzm.exe 1156 twrjpuegzm.exe 1156 twrjpuegzm.exe 1732 tyrlvparnmnhdlg.exe 1732 tyrlvparnmnhdlg.exe 1480 jdcbgsuv.exe 1480 jdcbgsuv.exe 1480 jdcbgsuv.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 532 jdcbgsuv.exe 532 jdcbgsuv.exe 532 jdcbgsuv.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exetyrlvparnmnhdlg.exetwrjpuegzm.exejdcbgsuv.exesvgrkzypycmba.exejdcbgsuv.exepid process 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe 1732 tyrlvparnmnhdlg.exe 1156 twrjpuegzm.exe 1156 twrjpuegzm.exe 1156 twrjpuegzm.exe 1732 tyrlvparnmnhdlg.exe 1732 tyrlvparnmnhdlg.exe 1480 jdcbgsuv.exe 1480 jdcbgsuv.exe 1480 jdcbgsuv.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 544 svgrkzypycmba.exe 532 jdcbgsuv.exe 532 jdcbgsuv.exe 532 jdcbgsuv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 808 WINWORD.EXE 808 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exetwrjpuegzm.exeWINWORD.EXEdescription pid process target process PID 1648 wrote to memory of 1156 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe twrjpuegzm.exe PID 1648 wrote to memory of 1156 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe twrjpuegzm.exe PID 1648 wrote to memory of 1156 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe twrjpuegzm.exe PID 1648 wrote to memory of 1156 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe twrjpuegzm.exe PID 1648 wrote to memory of 1732 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe tyrlvparnmnhdlg.exe PID 1648 wrote to memory of 1732 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe tyrlvparnmnhdlg.exe PID 1648 wrote to memory of 1732 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe tyrlvparnmnhdlg.exe PID 1648 wrote to memory of 1732 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe tyrlvparnmnhdlg.exe PID 1648 wrote to memory of 1480 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe jdcbgsuv.exe PID 1648 wrote to memory of 1480 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe jdcbgsuv.exe PID 1648 wrote to memory of 1480 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe jdcbgsuv.exe PID 1648 wrote to memory of 1480 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe jdcbgsuv.exe PID 1648 wrote to memory of 544 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe svgrkzypycmba.exe PID 1648 wrote to memory of 544 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe svgrkzypycmba.exe PID 1648 wrote to memory of 544 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe svgrkzypycmba.exe PID 1648 wrote to memory of 544 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe svgrkzypycmba.exe PID 1156 wrote to memory of 532 1156 twrjpuegzm.exe jdcbgsuv.exe PID 1156 wrote to memory of 532 1156 twrjpuegzm.exe jdcbgsuv.exe PID 1156 wrote to memory of 532 1156 twrjpuegzm.exe jdcbgsuv.exe PID 1156 wrote to memory of 532 1156 twrjpuegzm.exe jdcbgsuv.exe PID 1648 wrote to memory of 808 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe WINWORD.EXE PID 1648 wrote to memory of 808 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe WINWORD.EXE PID 1648 wrote to memory of 808 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe WINWORD.EXE PID 1648 wrote to memory of 808 1648 4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe WINWORD.EXE PID 808 wrote to memory of 2032 808 WINWORD.EXE splwow64.exe PID 808 wrote to memory of 2032 808 WINWORD.EXE splwow64.exe PID 808 wrote to memory of 2032 808 WINWORD.EXE splwow64.exe PID 808 wrote to memory of 2032 808 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe"C:\Users\Admin\AppData\Local\Temp\4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\twrjpuegzm.exetwrjpuegzm.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\jdcbgsuv.exeC:\Windows\system32\jdcbgsuv.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\tyrlvparnmnhdlg.exetyrlvparnmnhdlg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\jdcbgsuv.exejdcbgsuv.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\svgrkzypycmba.exesvgrkzypycmba.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
7Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\jdcbgsuv.exeFilesize
255KB
MD5966cb08aeaaff4bff51ccd32356346a7
SHA15fc8b93dea19b2a7c96238a391f776e10ef6ce85
SHA25693de833877595d97b35170205c701e0d943f760025658a0d629f86494dde681a
SHA512a9663a7d23d864097d65a804ab8970df3730826f1c8934455203bdec5d9cfe1a49e6218e536b5061c7addeb3106744e6dcf081a608333fa7e71f061d4db0d005
-
C:\Windows\SysWOW64\jdcbgsuv.exeFilesize
255KB
MD5966cb08aeaaff4bff51ccd32356346a7
SHA15fc8b93dea19b2a7c96238a391f776e10ef6ce85
SHA25693de833877595d97b35170205c701e0d943f760025658a0d629f86494dde681a
SHA512a9663a7d23d864097d65a804ab8970df3730826f1c8934455203bdec5d9cfe1a49e6218e536b5061c7addeb3106744e6dcf081a608333fa7e71f061d4db0d005
-
C:\Windows\SysWOW64\jdcbgsuv.exeFilesize
255KB
MD5966cb08aeaaff4bff51ccd32356346a7
SHA15fc8b93dea19b2a7c96238a391f776e10ef6ce85
SHA25693de833877595d97b35170205c701e0d943f760025658a0d629f86494dde681a
SHA512a9663a7d23d864097d65a804ab8970df3730826f1c8934455203bdec5d9cfe1a49e6218e536b5061c7addeb3106744e6dcf081a608333fa7e71f061d4db0d005
-
C:\Windows\SysWOW64\svgrkzypycmba.exeFilesize
255KB
MD52515a845b6533d7e322f87b1d83f309a
SHA10f971f78dffd9f4ce9b4c2e2d6b7dccad163e008
SHA256bb9b7b98cfd4e27e74180cafcbfc08966854d6c9a1af9f95558e5e051b3fed80
SHA512854e7ffd96d8420731a8850a5593caa3f7ebd3e489aad0349de44d47576b1a90d3ba6d7cf2ecf3511ba62a728d746eb80a6e6074cc7e4f191130e8ebc398ed29
-
C:\Windows\SysWOW64\svgrkzypycmba.exeFilesize
255KB
MD52515a845b6533d7e322f87b1d83f309a
SHA10f971f78dffd9f4ce9b4c2e2d6b7dccad163e008
SHA256bb9b7b98cfd4e27e74180cafcbfc08966854d6c9a1af9f95558e5e051b3fed80
SHA512854e7ffd96d8420731a8850a5593caa3f7ebd3e489aad0349de44d47576b1a90d3ba6d7cf2ecf3511ba62a728d746eb80a6e6074cc7e4f191130e8ebc398ed29
-
C:\Windows\SysWOW64\twrjpuegzm.exeFilesize
255KB
MD537df8cff3393ba35ea2801dede22c67e
SHA1b777736a95cb1726dc4d494d0856b92c8994a989
SHA2561c157398f68d3791b2764ec145b7a6580d51bc1e17e19883e4c7adc4cdebbdd4
SHA51281bd49f0fac42d6fd162a7d7f18f87e90ec6fe3e68e8b64cf4d1c80d50211471fe3d7ebf00ea1cd2e5fd9ab3ded5015d26dd19dfe0e74e520158e24132922933
-
C:\Windows\SysWOW64\twrjpuegzm.exeFilesize
255KB
MD537df8cff3393ba35ea2801dede22c67e
SHA1b777736a95cb1726dc4d494d0856b92c8994a989
SHA2561c157398f68d3791b2764ec145b7a6580d51bc1e17e19883e4c7adc4cdebbdd4
SHA51281bd49f0fac42d6fd162a7d7f18f87e90ec6fe3e68e8b64cf4d1c80d50211471fe3d7ebf00ea1cd2e5fd9ab3ded5015d26dd19dfe0e74e520158e24132922933
-
C:\Windows\SysWOW64\tyrlvparnmnhdlg.exeFilesize
255KB
MD5d7c7fdbfceed43f5d6a1f92153b2adc4
SHA14bf79f983b94ffd8e98f1ff352c43fa38e220a1a
SHA256ad2dbfabe19c89d87658794c8d481b409ed1b97393f3dee8c281f540f87f3900
SHA512c481c4cdaa2ab6a2475209d028ddc36e60325faa7b0d14078d622720c26b225b50aa989822e81d32e0154cdf015481d10af9d8c86762077f57df628eb6521069
-
C:\Windows\SysWOW64\tyrlvparnmnhdlg.exeFilesize
255KB
MD5d7c7fdbfceed43f5d6a1f92153b2adc4
SHA14bf79f983b94ffd8e98f1ff352c43fa38e220a1a
SHA256ad2dbfabe19c89d87658794c8d481b409ed1b97393f3dee8c281f540f87f3900
SHA512c481c4cdaa2ab6a2475209d028ddc36e60325faa7b0d14078d622720c26b225b50aa989822e81d32e0154cdf015481d10af9d8c86762077f57df628eb6521069
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\Windows\SysWOW64\jdcbgsuv.exeFilesize
255KB
MD5966cb08aeaaff4bff51ccd32356346a7
SHA15fc8b93dea19b2a7c96238a391f776e10ef6ce85
SHA25693de833877595d97b35170205c701e0d943f760025658a0d629f86494dde681a
SHA512a9663a7d23d864097d65a804ab8970df3730826f1c8934455203bdec5d9cfe1a49e6218e536b5061c7addeb3106744e6dcf081a608333fa7e71f061d4db0d005
-
\Windows\SysWOW64\jdcbgsuv.exeFilesize
255KB
MD5966cb08aeaaff4bff51ccd32356346a7
SHA15fc8b93dea19b2a7c96238a391f776e10ef6ce85
SHA25693de833877595d97b35170205c701e0d943f760025658a0d629f86494dde681a
SHA512a9663a7d23d864097d65a804ab8970df3730826f1c8934455203bdec5d9cfe1a49e6218e536b5061c7addeb3106744e6dcf081a608333fa7e71f061d4db0d005
-
\Windows\SysWOW64\svgrkzypycmba.exeFilesize
255KB
MD52515a845b6533d7e322f87b1d83f309a
SHA10f971f78dffd9f4ce9b4c2e2d6b7dccad163e008
SHA256bb9b7b98cfd4e27e74180cafcbfc08966854d6c9a1af9f95558e5e051b3fed80
SHA512854e7ffd96d8420731a8850a5593caa3f7ebd3e489aad0349de44d47576b1a90d3ba6d7cf2ecf3511ba62a728d746eb80a6e6074cc7e4f191130e8ebc398ed29
-
\Windows\SysWOW64\twrjpuegzm.exeFilesize
255KB
MD537df8cff3393ba35ea2801dede22c67e
SHA1b777736a95cb1726dc4d494d0856b92c8994a989
SHA2561c157398f68d3791b2764ec145b7a6580d51bc1e17e19883e4c7adc4cdebbdd4
SHA51281bd49f0fac42d6fd162a7d7f18f87e90ec6fe3e68e8b64cf4d1c80d50211471fe3d7ebf00ea1cd2e5fd9ab3ded5015d26dd19dfe0e74e520158e24132922933
-
\Windows\SysWOW64\tyrlvparnmnhdlg.exeFilesize
255KB
MD5d7c7fdbfceed43f5d6a1f92153b2adc4
SHA14bf79f983b94ffd8e98f1ff352c43fa38e220a1a
SHA256ad2dbfabe19c89d87658794c8d481b409ed1b97393f3dee8c281f540f87f3900
SHA512c481c4cdaa2ab6a2475209d028ddc36e60325faa7b0d14078d622720c26b225b50aa989822e81d32e0154cdf015481d10af9d8c86762077f57df628eb6521069
-
memory/532-92-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/532-102-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/532-85-0x0000000000000000-mapping.dmp
-
memory/544-68-0x0000000000000000-mapping.dmp
-
memory/544-101-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/544-82-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/808-91-0x00000000728E1000-0x00000000728E4000-memory.dmpFilesize
12KB
-
memory/808-93-0x0000000070361000-0x0000000070363000-memory.dmpFilesize
8KB
-
memory/808-103-0x000000007134D000-0x0000000071358000-memory.dmpFilesize
44KB
-
memory/808-88-0x0000000000000000-mapping.dmp
-
memory/808-97-0x000000007134D000-0x0000000071358000-memory.dmpFilesize
44KB
-
memory/808-94-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1156-78-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1156-98-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1156-90-0x0000000003860000-0x0000000003900000-memory.dmpFilesize
640KB
-
memory/1156-58-0x0000000000000000-mapping.dmp
-
memory/1480-81-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1480-100-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1480-66-0x0000000000000000-mapping.dmp
-
memory/1648-77-0x0000000003340000-0x00000000033E0000-memory.dmpFilesize
640KB
-
memory/1648-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmpFilesize
8KB
-
memory/1648-89-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1648-83-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1648-57-0x0000000003340000-0x00000000033E0000-memory.dmpFilesize
640KB
-
memory/1648-56-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1648-79-0x0000000003340000-0x00000000033E0000-memory.dmpFilesize
640KB
-
memory/1732-60-0x0000000000000000-mapping.dmp
-
memory/1732-80-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1732-99-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2032-104-0x0000000000000000-mapping.dmp