c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
Size

255KB
MD5

91cce18dd72b826d31a9bba6519aec8c
SHA1

7c5915088642e7637c74a54453b32619201b8304
SHA256

c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc
SHA512

956f01171358d45a48f2e55d05e0ace3b9a885010a67c566045f017c5c1b2ca82904e9b5293c738b98532a11b79e98dd29ad32dd79fc18636896a67e2a027c86
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIc

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

tiitdjkrxp.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	tiitdjkrxp.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

tiitdjkrxp.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	tiitdjkrxp.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tiitdjkrxp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	tiitdjkrxp.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

tiitdjkrxp.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	tiitdjkrxp.exe

Executes dropped EXE 6 IoCs

Processes:

tiitdjkrxp.exexoctphfzyanxbbo.exekprxvbvv.exefbbvgfhznanjl.exefbbvgfhznanjl.exekprxvbvv.exe

pid process

928 tiitdjkrxp.exe
1552 xoctphfzyanxbbo.exe
1556 kprxvbvv.exe
1412 fbbvgfhznanjl.exe
912 fbbvgfhznanjl.exe
428 kprxvbvv.exe

pid	process
928	tiitdjkrxp.exe
1552	xoctphfzyanxbbo.exe
1556	kprxvbvv.exe
1412	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
428	kprxvbvv.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1488-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\tiitdjkrxp.exe	upx
C:\Windows\SysWOW64\tiitdjkrxp.exe	upx
C:\Windows\SysWOW64\tiitdjkrxp.exe	upx
\Windows\SysWOW64\xoctphfzyanxbbo.exe	upx
C:\Windows\SysWOW64\xoctphfzyanxbbo.exe	upx
\Windows\SysWOW64\kprxvbvv.exe	upx
C:\Windows\SysWOW64\kprxvbvv.exe	upx
C:\Windows\SysWOW64\xoctphfzyanxbbo.exe	upx
\Windows\SysWOW64\fbbvgfhznanjl.exe	upx
C:\Windows\SysWOW64\kprxvbvv.exe	upx
C:\Windows\SysWOW64\fbbvgfhznanjl.exe	upx
C:\Windows\SysWOW64\fbbvgfhznanjl.exe	upx
\Windows\SysWOW64\fbbvgfhznanjl.exe	upx
C:\Windows\SysWOW64\fbbvgfhznanjl.exe	upx
behavioral1/memory/928-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1552-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1556-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1412-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\kprxvbvv.exe	upx
behavioral1/memory/912-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\kprxvbvv.exe	upx
behavioral1/memory/1488-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/428-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1412-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/928-101-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1552-102-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1556-103-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/912-104-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/928-105-0x0000000003860000-0x0000000003900000-memory.dmp	upx
behavioral1/memory/428-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	upx
C:\Users\Admin\Music\CompareCheckpoint.doc.exe	upx

Loads dropped DLL 6 IoCs

Processes:

c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.execmd.exetiitdjkrxp.exe

pid	process
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1604	cmd.exe
928	tiitdjkrxp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tiitdjkrxp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	tiitdjkrxp.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

xoctphfzyanxbbo.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	xoctphfzyanxbbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\csabpkbf = "tiitdjkrxp.exe"	xoctphfzyanxbbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lkphjaju = "xoctphfzyanxbbo.exe"	xoctphfzyanxbbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "fbbvgfhznanjl.exe"	xoctphfzyanxbbo.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

kprxvbvv.exekprxvbvv.exetiitdjkrxp.exe

description	ioc	process
File opened (read-only)	\??\r:	kprxvbvv.exe
File opened (read-only)	\??\v:	kprxvbvv.exe
File opened (read-only)	\??\l:	kprxvbvv.exe
File opened (read-only)	\??\f:	kprxvbvv.exe
File opened (read-only)	\??\x:	tiitdjkrxp.exe
File opened (read-only)	\??\e:	kprxvbvv.exe
File opened (read-only)	\??\p:	tiitdjkrxp.exe
File opened (read-only)	\??\w:	tiitdjkrxp.exe
File opened (read-only)	\??\g:	kprxvbvv.exe
File opened (read-only)	\??\h:	kprxvbvv.exe
File opened (read-only)	\??\i:	kprxvbvv.exe
File opened (read-only)	\??\z:	kprxvbvv.exe
File opened (read-only)	\??\n:	kprxvbvv.exe
File opened (read-only)	\??\r:	tiitdjkrxp.exe
File opened (read-only)	\??\t:	kprxvbvv.exe
File opened (read-only)	\??\a:	tiitdjkrxp.exe
File opened (read-only)	\??\g:	tiitdjkrxp.exe
File opened (read-only)	\??\l:	tiitdjkrxp.exe
File opened (read-only)	\??\w:	kprxvbvv.exe
File opened (read-only)	\??\u:	kprxvbvv.exe
File opened (read-only)	\??\k:	kprxvbvv.exe
File opened (read-only)	\??\b:	tiitdjkrxp.exe
File opened (read-only)	\??\n:	tiitdjkrxp.exe
File opened (read-only)	\??\v:	tiitdjkrxp.exe
File opened (read-only)	\??\z:	tiitdjkrxp.exe
File opened (read-only)	\??\a:	kprxvbvv.exe
File opened (read-only)	\??\a:	kprxvbvv.exe
File opened (read-only)	\??\u:	kprxvbvv.exe
File opened (read-only)	\??\t:	kprxvbvv.exe
File opened (read-only)	\??\q:	tiitdjkrxp.exe
File opened (read-only)	\??\q:	kprxvbvv.exe
File opened (read-only)	\??\s:	kprxvbvv.exe
File opened (read-only)	\??\s:	kprxvbvv.exe
File opened (read-only)	\??\y:	tiitdjkrxp.exe
File opened (read-only)	\??\p:	kprxvbvv.exe
File opened (read-only)	\??\g:	kprxvbvv.exe
File opened (read-only)	\??\o:	tiitdjkrxp.exe
File opened (read-only)	\??\r:	kprxvbvv.exe
File opened (read-only)	\??\x:	kprxvbvv.exe
File opened (read-only)	\??\m:	kprxvbvv.exe
File opened (read-only)	\??\z:	kprxvbvv.exe
File opened (read-only)	\??\k:	tiitdjkrxp.exe
File opened (read-only)	\??\j:	kprxvbvv.exe
File opened (read-only)	\??\m:	kprxvbvv.exe
File opened (read-only)	\??\n:	kprxvbvv.exe
File opened (read-only)	\??\i:	kprxvbvv.exe
File opened (read-only)	\??\q:	kprxvbvv.exe
File opened (read-only)	\??\v:	kprxvbvv.exe
File opened (read-only)	\??\w:	kprxvbvv.exe
File opened (read-only)	\??\e:	tiitdjkrxp.exe
File opened (read-only)	\??\t:	tiitdjkrxp.exe
File opened (read-only)	\??\l:	kprxvbvv.exe
File opened (read-only)	\??\o:	kprxvbvv.exe
File opened (read-only)	\??\h:	kprxvbvv.exe
File opened (read-only)	\??\o:	kprxvbvv.exe
File opened (read-only)	\??\p:	kprxvbvv.exe
File opened (read-only)	\??\u:	tiitdjkrxp.exe
File opened (read-only)	\??\b:	kprxvbvv.exe
File opened (read-only)	\??\f:	kprxvbvv.exe
File opened (read-only)	\??\k:	kprxvbvv.exe
File opened (read-only)	\??\b:	kprxvbvv.exe
File opened (read-only)	\??\f:	tiitdjkrxp.exe
File opened (read-only)	\??\h:	tiitdjkrxp.exe
File opened (read-only)	\??\j:	tiitdjkrxp.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

tiitdjkrxp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	tiitdjkrxp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	tiitdjkrxp.exe

AutoIT Executable 15 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1488-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/928-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1552-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1556-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1412-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/912-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1488-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/428-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1412-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/928-101-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1552-102-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1556-103-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/912-104-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/928-105-0x0000000003860000-0x0000000003900000-memory.dmp	autoit_exe
behavioral1/memory/428-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exetiitdjkrxp.exe

description	ioc	process
File created	C:\Windows\SysWOW64\tiitdjkrxp.exe	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
File opened for modification	C:\Windows\SysWOW64\tiitdjkrxp.exe	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
File created	C:\Windows\SysWOW64\kprxvbvv.exe	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
File created	C:\Windows\SysWOW64\fbbvgfhznanjl.exe	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	tiitdjkrxp.exe
File created	C:\Windows\SysWOW64\xoctphfzyanxbbo.exe	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
File opened for modification	C:\Windows\SysWOW64\xoctphfzyanxbbo.exe	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
File opened for modification	C:\Windows\SysWOW64\kprxvbvv.exe	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
File opened for modification	C:\Windows\SysWOW64\fbbvgfhznanjl.exe	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe

Drops file in Program Files directory 14 IoCs

Processes:

kprxvbvv.exekprxvbvv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	kprxvbvv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kprxvbvv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kprxvbvv.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kprxvbvv.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kprxvbvv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	kprxvbvv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kprxvbvv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kprxvbvv.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	kprxvbvv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	kprxvbvv.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	kprxvbvv.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kprxvbvv.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kprxvbvv.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	kprxvbvv.exe

Drops file in Windows directory 5 IoCs

Processes:

c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEtiitdjkrxp.exec5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	tiitdjkrxp.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8CFFFC485D82689146D7217D9DBCE7E13C594667326334D798"	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472C089C2082206A4176A170562DDC7C8665D9"	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDFABBF911F2E284093B32869D3EE2B3FD028A43660248E1CC429B08A5"	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	tiitdjkrxp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F268B6FE1C21DAD10BD0A58A7B9117"	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1840 WINWORD.EXE

pid	process
1840	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exetiitdjkrxp.exexoctphfzyanxbbo.exekprxvbvv.exefbbvgfhznanjl.exefbbvgfhznanjl.exekprxvbvv.exe

pid	process
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
928	tiitdjkrxp.exe
928	tiitdjkrxp.exe
928	tiitdjkrxp.exe
928	tiitdjkrxp.exe
928	tiitdjkrxp.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1552	xoctphfzyanxbbo.exe
1552	xoctphfzyanxbbo.exe
1552	xoctphfzyanxbbo.exe
1552	xoctphfzyanxbbo.exe
1552	xoctphfzyanxbbo.exe
1556	kprxvbvv.exe
1556	kprxvbvv.exe
1556	kprxvbvv.exe
1556	kprxvbvv.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
1552	xoctphfzyanxbbo.exe
428	kprxvbvv.exe
428	kprxvbvv.exe
428	kprxvbvv.exe
428	kprxvbvv.exe
1552	xoctphfzyanxbbo.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
1552	xoctphfzyanxbbo.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
1552	xoctphfzyanxbbo.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
1552	xoctphfzyanxbbo.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
1552	xoctphfzyanxbbo.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exetiitdjkrxp.exexoctphfzyanxbbo.exekprxvbvv.exefbbvgfhznanjl.exefbbvgfhznanjl.exekprxvbvv.exe

pid	process
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
928	tiitdjkrxp.exe
928	tiitdjkrxp.exe
928	tiitdjkrxp.exe
1552	xoctphfzyanxbbo.exe
1552	xoctphfzyanxbbo.exe
1552	xoctphfzyanxbbo.exe
1556	kprxvbvv.exe
1556	kprxvbvv.exe
1556	kprxvbvv.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
428	kprxvbvv.exe
428	kprxvbvv.exe
428	kprxvbvv.exe

Suspicious use of SendNotifyMessage 21 IoCs

Processes:

c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exetiitdjkrxp.exexoctphfzyanxbbo.exekprxvbvv.exefbbvgfhznanjl.exefbbvgfhznanjl.exekprxvbvv.exe

pid	process
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
928	tiitdjkrxp.exe
928	tiitdjkrxp.exe
928	tiitdjkrxp.exe
1552	xoctphfzyanxbbo.exe
1552	xoctphfzyanxbbo.exe
1552	xoctphfzyanxbbo.exe
1556	kprxvbvv.exe
1556	kprxvbvv.exe
1556	kprxvbvv.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
1412	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
912	fbbvgfhznanjl.exe
428	kprxvbvv.exe
428	kprxvbvv.exe
428	kprxvbvv.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1840 WINWORD.EXE
1840 WINWORD.EXE

pid	process
1840	WINWORD.EXE
1840	WINWORD.EXE

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exexoctphfzyanxbbo.execmd.exetiitdjkrxp.exeWINWORD.EXE

description	pid	process	target process
PID 1488 wrote to memory of 928	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	tiitdjkrxp.exe
PID 1488 wrote to memory of 928	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	tiitdjkrxp.exe
PID 1488 wrote to memory of 928	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	tiitdjkrxp.exe
PID 1488 wrote to memory of 928	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	tiitdjkrxp.exe
PID 1488 wrote to memory of 1552	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	xoctphfzyanxbbo.exe
PID 1488 wrote to memory of 1552	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	xoctphfzyanxbbo.exe
PID 1488 wrote to memory of 1552	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	xoctphfzyanxbbo.exe
PID 1488 wrote to memory of 1552	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	xoctphfzyanxbbo.exe
PID 1488 wrote to memory of 1556	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	kprxvbvv.exe
PID 1488 wrote to memory of 1556	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	kprxvbvv.exe
PID 1488 wrote to memory of 1556	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	kprxvbvv.exe
PID 1488 wrote to memory of 1556	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	kprxvbvv.exe
PID 1488 wrote to memory of 1412	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	fbbvgfhznanjl.exe
PID 1488 wrote to memory of 1412	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	fbbvgfhznanjl.exe
PID 1488 wrote to memory of 1412	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	fbbvgfhznanjl.exe
PID 1488 wrote to memory of 1412	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	fbbvgfhznanjl.exe
PID 1552 wrote to memory of 1604	1552	xoctphfzyanxbbo.exe	cmd.exe
PID 1552 wrote to memory of 1604	1552	xoctphfzyanxbbo.exe	cmd.exe
PID 1552 wrote to memory of 1604	1552	xoctphfzyanxbbo.exe	cmd.exe
PID 1552 wrote to memory of 1604	1552	xoctphfzyanxbbo.exe	cmd.exe
PID 1604 wrote to memory of 912	1604	cmd.exe	fbbvgfhznanjl.exe
PID 1604 wrote to memory of 912	1604	cmd.exe	fbbvgfhznanjl.exe
PID 1604 wrote to memory of 912	1604	cmd.exe	fbbvgfhznanjl.exe
PID 1604 wrote to memory of 912	1604	cmd.exe	fbbvgfhznanjl.exe
PID 928 wrote to memory of 428	928	tiitdjkrxp.exe	kprxvbvv.exe
PID 928 wrote to memory of 428	928	tiitdjkrxp.exe	kprxvbvv.exe
PID 928 wrote to memory of 428	928	tiitdjkrxp.exe	kprxvbvv.exe
PID 928 wrote to memory of 428	928	tiitdjkrxp.exe	kprxvbvv.exe
PID 1488 wrote to memory of 1840	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	WINWORD.EXE
PID 1488 wrote to memory of 1840	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	WINWORD.EXE
PID 1488 wrote to memory of 1840	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	WINWORD.EXE
PID 1488 wrote to memory of 1840	1488	c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe	WINWORD.EXE
PID 1840 wrote to memory of 1796	1840	WINWORD.EXE	splwow64.exe
PID 1840 wrote to memory of 1796	1840	WINWORD.EXE	splwow64.exe
PID 1840 wrote to memory of 1796	1840	WINWORD.EXE	splwow64.exe
PID 1840 wrote to memory of 1796	1840	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
"C:\Users\Admin\AppData\Local\Temp\c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\tiitdjkrxp.exe
tiitdjkrxp.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:928

C:\Windows\SysWOW64\kprxvbvv.exe
C:\Windows\system32\kprxvbvv.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:428

C:\Windows\SysWOW64\xoctphfzyanxbbo.exe
xoctphfzyanxbbo.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c fbbvgfhznanjl.exe
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\fbbvgfhznanjl.exe
fbbvgfhznanjl.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:912

C:\Windows\SysWOW64\kprxvbvv.exe
kprxvbvv.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1556

C:\Windows\SysWOW64\fbbvgfhznanjl.exe
fbbvgfhznanjl.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1412

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
942fba706d674887434f3c55538157a6

SHA1
4487c548dc123a2e35fa9f8939b32f6ef7c79c0d

SHA256
40ea24e4044f85324594b4a06e69210b137c746baa0106c670416601cea9a75e

SHA512
55d278ab6e930c0834312368cd95ea990e438b2886dedcd81b58f0401a2bc0110d5f75c34f4e2791a82265736e06484797d8773ed762e6a57eb5882cb4b969af

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
6e1d4b0033002473403cba77d46d859a

SHA1
79bf2610b19fb582ab26763e374adec501d4437a

SHA256
8bfdae10eeca014026e59ae0342b14b0d5f69e6d325ccba01fb1aa3d29d2980c

SHA512
6614e0a4e95b2a583f6d552ef68e7c7e3884ceea2cb1f15817367689381fa982e4505a50547aa6b8e0f5495f690fe6ed3002b6f1d81358dc3462b218d7b7dc38

Download Submit
C:\Users\Admin\Music\CompareCheckpoint.doc.exe

Filesize
255KB

MD5
5aab303350fccfe8202ccaedb696a636

SHA1
44191c8b2ad689bb07fd95404140a94f11e8e9d4

SHA256
57791c639ac679985856f52cf8371546f7f052343010db5c81d578ff9ba487b7

SHA512
5936822e55bf5fc1723d360b39cb1c192857c8e4e6f6bcc415f5a9f7a534e5b4fc73c4157eb6a58586be3ef6ad904f9251e236aad2fcf8676c718d13f9390d8d

Download Submit
C:\Windows\SysWOW64\fbbvgfhznanjl.exe

Filesize
255KB

MD5
7daa0c77312bde13152a311342f2a7c9

SHA1
412217c7f7a1bc72ef563924203d712f6e87408f

SHA256
27ac74df7c4637632c8d49b3219099c0a2dc5397b0a0298908f5ab7dccbe4076

SHA512
a5dd3c5e7c91101c9d9605ab343d9c361e9d577103695f398d00f0f38d24188d602332355cb009c7774892ba9c1ca74576308d46bffc1eb18113e6fb1c2f94cb

Download Submit
C:\Windows\SysWOW64\fbbvgfhznanjl.exe

Filesize
255KB

MD5
7daa0c77312bde13152a311342f2a7c9

SHA1
412217c7f7a1bc72ef563924203d712f6e87408f

SHA256
27ac74df7c4637632c8d49b3219099c0a2dc5397b0a0298908f5ab7dccbe4076

SHA512
a5dd3c5e7c91101c9d9605ab343d9c361e9d577103695f398d00f0f38d24188d602332355cb009c7774892ba9c1ca74576308d46bffc1eb18113e6fb1c2f94cb

Download Submit
C:\Windows\SysWOW64\fbbvgfhznanjl.exe

Filesize
255KB

MD5
7daa0c77312bde13152a311342f2a7c9

SHA1
412217c7f7a1bc72ef563924203d712f6e87408f

SHA256
27ac74df7c4637632c8d49b3219099c0a2dc5397b0a0298908f5ab7dccbe4076

SHA512
a5dd3c5e7c91101c9d9605ab343d9c361e9d577103695f398d00f0f38d24188d602332355cb009c7774892ba9c1ca74576308d46bffc1eb18113e6fb1c2f94cb

Download Submit
C:\Windows\SysWOW64\kprxvbvv.exe

Filesize
255KB

MD5
3cbe1c68a6d26f01e74895787f38ade5

SHA1
c3676cf2f8e77c5bd996f4800b8388d0d0abecd3

SHA256
c37d6982d51e8ebb62a5d1c14ecf9427b99085ca7aaf0e2febe5c338a9b89e64

SHA512
2ef0bed2563383ecf09f8753acdb4b03f2e95a49422b00a29d4307d72de1dda4ca5ecc06f64682eb64c7ee7ef91fcf5306be70862454b1133f4009a202f7eaca

Download Submit
C:\Windows\SysWOW64\kprxvbvv.exe

Filesize
255KB

MD5
3cbe1c68a6d26f01e74895787f38ade5

SHA1
c3676cf2f8e77c5bd996f4800b8388d0d0abecd3

SHA256
c37d6982d51e8ebb62a5d1c14ecf9427b99085ca7aaf0e2febe5c338a9b89e64

SHA512
2ef0bed2563383ecf09f8753acdb4b03f2e95a49422b00a29d4307d72de1dda4ca5ecc06f64682eb64c7ee7ef91fcf5306be70862454b1133f4009a202f7eaca

Download Submit
C:\Windows\SysWOW64\kprxvbvv.exe

Filesize
255KB

MD5
3cbe1c68a6d26f01e74895787f38ade5

SHA1
c3676cf2f8e77c5bd996f4800b8388d0d0abecd3

SHA256
c37d6982d51e8ebb62a5d1c14ecf9427b99085ca7aaf0e2febe5c338a9b89e64

SHA512
2ef0bed2563383ecf09f8753acdb4b03f2e95a49422b00a29d4307d72de1dda4ca5ecc06f64682eb64c7ee7ef91fcf5306be70862454b1133f4009a202f7eaca

Download Submit
C:\Windows\SysWOW64\tiitdjkrxp.exe

Filesize
255KB

MD5
8b698e3c959e4a5b4d90995dd674a17e

SHA1
f9850e00da47c33badabc64949291d0b7dcba0b9

SHA256
2162463a889de3636b0e4054be21ad62d1609139ba338cc319c37890b28ea082

SHA512
66d654252c454c91542d57cb486c88d3b176b7dc91f8356ecf351c91781a457f31e129d3772f9f203892ef4cc2511c7b50a95c2eab11e0f41a244dc38944c2c8

Download Submit
C:\Windows\SysWOW64\tiitdjkrxp.exe

Filesize
255KB

MD5
8b698e3c959e4a5b4d90995dd674a17e

SHA1
f9850e00da47c33badabc64949291d0b7dcba0b9

SHA256
2162463a889de3636b0e4054be21ad62d1609139ba338cc319c37890b28ea082

SHA512
66d654252c454c91542d57cb486c88d3b176b7dc91f8356ecf351c91781a457f31e129d3772f9f203892ef4cc2511c7b50a95c2eab11e0f41a244dc38944c2c8

Download Submit
C:\Windows\SysWOW64\xoctphfzyanxbbo.exe

Filesize
255KB

MD5
c87ab1577361b359124175076938bb2b

SHA1
513d55f8d7974f3c7e25064dc2ae5544175bce05

SHA256
4950389bfd381fd312d436562f22d72068930f18c96ede3d05b6799282d9a67a

SHA512
8f8b57875af6cb4412e2f0c4a82a2ea694bd9b3634c5e6f7e855b284e08f3518a6538811c92ee928c0e7d85c268fe50ac3b4ef7c5b67d207ac8753a63face2ed

Download Submit
C:\Windows\SysWOW64\xoctphfzyanxbbo.exe

Filesize
255KB

MD5
c87ab1577361b359124175076938bb2b

SHA1
513d55f8d7974f3c7e25064dc2ae5544175bce05

SHA256
4950389bfd381fd312d436562f22d72068930f18c96ede3d05b6799282d9a67a

SHA512
8f8b57875af6cb4412e2f0c4a82a2ea694bd9b3634c5e6f7e855b284e08f3518a6538811c92ee928c0e7d85c268fe50ac3b4ef7c5b67d207ac8753a63face2ed

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\fbbvgfhznanjl.exe

Filesize
255KB

MD5
7daa0c77312bde13152a311342f2a7c9

SHA1
412217c7f7a1bc72ef563924203d712f6e87408f

SHA256
27ac74df7c4637632c8d49b3219099c0a2dc5397b0a0298908f5ab7dccbe4076

SHA512
a5dd3c5e7c91101c9d9605ab343d9c361e9d577103695f398d00f0f38d24188d602332355cb009c7774892ba9c1ca74576308d46bffc1eb18113e6fb1c2f94cb

Download Submit
\Windows\SysWOW64\fbbvgfhznanjl.exe

Filesize
255KB

MD5
7daa0c77312bde13152a311342f2a7c9

SHA1
412217c7f7a1bc72ef563924203d712f6e87408f

SHA256
27ac74df7c4637632c8d49b3219099c0a2dc5397b0a0298908f5ab7dccbe4076

SHA512
a5dd3c5e7c91101c9d9605ab343d9c361e9d577103695f398d00f0f38d24188d602332355cb009c7774892ba9c1ca74576308d46bffc1eb18113e6fb1c2f94cb

Download Submit
\Windows\SysWOW64\kprxvbvv.exe

Filesize
255KB

MD5
3cbe1c68a6d26f01e74895787f38ade5

SHA1
c3676cf2f8e77c5bd996f4800b8388d0d0abecd3

SHA256
c37d6982d51e8ebb62a5d1c14ecf9427b99085ca7aaf0e2febe5c338a9b89e64

SHA512
2ef0bed2563383ecf09f8753acdb4b03f2e95a49422b00a29d4307d72de1dda4ca5ecc06f64682eb64c7ee7ef91fcf5306be70862454b1133f4009a202f7eaca

Download Submit
\Windows\SysWOW64\kprxvbvv.exe

Filesize
255KB

MD5
3cbe1c68a6d26f01e74895787f38ade5

SHA1
c3676cf2f8e77c5bd996f4800b8388d0d0abecd3

SHA256
c37d6982d51e8ebb62a5d1c14ecf9427b99085ca7aaf0e2febe5c338a9b89e64

SHA512
2ef0bed2563383ecf09f8753acdb4b03f2e95a49422b00a29d4307d72de1dda4ca5ecc06f64682eb64c7ee7ef91fcf5306be70862454b1133f4009a202f7eaca

Download Submit
\Windows\SysWOW64\tiitdjkrxp.exe

Filesize
255KB

MD5
8b698e3c959e4a5b4d90995dd674a17e

SHA1
f9850e00da47c33badabc64949291d0b7dcba0b9

SHA256
2162463a889de3636b0e4054be21ad62d1609139ba338cc319c37890b28ea082

SHA512
66d654252c454c91542d57cb486c88d3b176b7dc91f8356ecf351c91781a457f31e129d3772f9f203892ef4cc2511c7b50a95c2eab11e0f41a244dc38944c2c8

Download Submit
\Windows\SysWOW64\xoctphfzyanxbbo.exe

Filesize
255KB

MD5
c87ab1577361b359124175076938bb2b

SHA1
513d55f8d7974f3c7e25064dc2ae5544175bce05

SHA256
4950389bfd381fd312d436562f22d72068930f18c96ede3d05b6799282d9a67a

SHA512
8f8b57875af6cb4412e2f0c4a82a2ea694bd9b3634c5e6f7e855b284e08f3518a6538811c92ee928c0e7d85c268fe50ac3b4ef7c5b67d207ac8753a63face2ed

Download Submit
memory/428-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/428-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/428-87-0x0000000000000000-mapping.dmp

Download
memory/912-78-0x0000000000000000-mapping.dmp

Download
memory/912-104-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/912-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/928-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/928-101-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/928-105-0x0000000003860000-0x0000000003900000-memory.dmp

Filesize
640KB

Download
memory/928-57-0x0000000000000000-mapping.dmp

Download
memory/1412-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1412-71-0x0000000000000000-mapping.dmp

Download
memory/1412-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1488-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1488-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1488-81-0x00000000033B0000-0x0000000003450000-memory.dmp

Filesize
640KB

Download
memory/1488-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1552-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1552-102-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1552-62-0x0000000000000000-mapping.dmp

Download
memory/1556-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1556-66-0x0000000000000000-mapping.dmp

Download
memory/1556-103-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1604-76-0x0000000000000000-mapping.dmp

Download
memory/1796-107-0x0000000000000000-mapping.dmp

Download
memory/1796-108-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Filesize
8KB

Download
memory/1840-99-0x0000000070AED000-0x0000000070AF8000-memory.dmp

Filesize
44KB

Download
memory/1840-91-0x0000000000000000-mapping.dmp

Download
memory/1840-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1840-94-0x000000006FB01000-0x000000006FB03000-memory.dmp

Filesize
8KB

Download
memory/1840-93-0x0000000072081000-0x0000000072084000-memory.dmp

Filesize
12KB

Download
memory/1840-112-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1840-113-0x0000000070AED000-0x0000000070AF8000-memory.dmp

Filesize
44KB

Download