be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26

Analysis

max time kernel
153s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
Size

255KB
MD5

76a179876a2583c550f358966c3158c6
SHA1

0936c8410e3a4e53ae488d8a09fe3ece4f7dc22a
SHA256

be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26
SHA512

1f904e847443e68ade0d48b2262a572f41da1a7a1561916c498e07d50a0408dde72a810de758cac68b22437e26caaf9aaaf1739535839e01207a34f71c1d7cb9
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJd:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIO

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

qfftdsqnrz.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	qfftdsqnrz.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

qfftdsqnrz.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qfftdsqnrz.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

qfftdsqnrz.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qfftdsqnrz.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

qfftdsqnrz.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	qfftdsqnrz.exe

Executes dropped EXE 5 IoCs

Processes:

qfftdsqnrz.exebhqziyhedvgtffn.exegbybufws.exepwhesomoahbzg.exegbybufws.exe

pid process

820 qfftdsqnrz.exe
672 bhqziyhedvgtffn.exe
1088 gbybufws.exe
676 pwhesomoahbzg.exe
1548 gbybufws.exe

pid	process
820	qfftdsqnrz.exe
672	bhqziyhedvgtffn.exe
1088	gbybufws.exe
676	pwhesomoahbzg.exe
1548	gbybufws.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1184-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\qfftdsqnrz.exe	upx
behavioral1/memory/1184-57-0x00000000023B0000-0x0000000002450000-memory.dmp	upx
C:\Windows\SysWOW64\qfftdsqnrz.exe	upx
\Windows\SysWOW64\bhqziyhedvgtffn.exe	upx
\Windows\SysWOW64\gbybufws.exe	upx
C:\Windows\SysWOW64\bhqziyhedvgtffn.exe	upx
C:\Windows\SysWOW64\gbybufws.exe	upx
\Windows\SysWOW64\pwhesomoahbzg.exe	upx
C:\Windows\SysWOW64\qfftdsqnrz.exe	upx
C:\Windows\SysWOW64\bhqziyhedvgtffn.exe	upx
C:\Windows\SysWOW64\pwhesomoahbzg.exe	upx
C:\Windows\SysWOW64\pwhesomoahbzg.exe	upx
C:\Windows\SysWOW64\gbybufws.exe	upx
\Windows\SysWOW64\gbybufws.exe	upx
behavioral1/memory/820-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/672-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1088-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/676-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1184-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\gbybufws.exe	upx
behavioral1/memory/1184-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1548-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/820-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/672-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1088-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/676-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1548-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	upx

Loads dropped DLL 5 IoCs

Processes:

be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exeqfftdsqnrz.exe

pid	process
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
820	qfftdsqnrz.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

qfftdsqnrz.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	qfftdsqnrz.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bhqziyhedvgtffn.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	bhqziyhedvgtffn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yjjxbzzx = "qfftdsqnrz.exe"	bhqziyhedvgtffn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ymksiqpa = "bhqziyhedvgtffn.exe"	bhqziyhedvgtffn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "pwhesomoahbzg.exe"	bhqziyhedvgtffn.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

gbybufws.exegbybufws.exeqfftdsqnrz.exe

description	ioc	process
File opened (read-only)	\??\s:	gbybufws.exe
File opened (read-only)	\??\q:	gbybufws.exe
File opened (read-only)	\??\h:	qfftdsqnrz.exe
File opened (read-only)	\??\s:	qfftdsqnrz.exe
File opened (read-only)	\??\p:	gbybufws.exe
File opened (read-only)	\??\z:	gbybufws.exe
File opened (read-only)	\??\g:	gbybufws.exe
File opened (read-only)	\??\n:	gbybufws.exe
File opened (read-only)	\??\v:	gbybufws.exe
File opened (read-only)	\??\x:	gbybufws.exe
File opened (read-only)	\??\b:	qfftdsqnrz.exe
File opened (read-only)	\??\f:	qfftdsqnrz.exe
File opened (read-only)	\??\j:	qfftdsqnrz.exe
File opened (read-only)	\??\f:	gbybufws.exe
File opened (read-only)	\??\r:	gbybufws.exe
File opened (read-only)	\??\f:	gbybufws.exe
File opened (read-only)	\??\p:	gbybufws.exe
File opened (read-only)	\??\w:	gbybufws.exe
File opened (read-only)	\??\e:	qfftdsqnrz.exe
File opened (read-only)	\??\n:	qfftdsqnrz.exe
File opened (read-only)	\??\p:	qfftdsqnrz.exe
File opened (read-only)	\??\r:	qfftdsqnrz.exe
File opened (read-only)	\??\a:	gbybufws.exe
File opened (read-only)	\??\o:	gbybufws.exe
File opened (read-only)	\??\x:	gbybufws.exe
File opened (read-only)	\??\k:	qfftdsqnrz.exe
File opened (read-only)	\??\l:	qfftdsqnrz.exe
File opened (read-only)	\??\l:	gbybufws.exe
File opened (read-only)	\??\m:	gbybufws.exe
File opened (read-only)	\??\w:	qfftdsqnrz.exe
File opened (read-only)	\??\z:	qfftdsqnrz.exe
File opened (read-only)	\??\j:	gbybufws.exe
File opened (read-only)	\??\o:	gbybufws.exe
File opened (read-only)	\??\g:	gbybufws.exe
File opened (read-only)	\??\n:	gbybufws.exe
File opened (read-only)	\??\t:	qfftdsqnrz.exe
File opened (read-only)	\??\u:	qfftdsqnrz.exe
File opened (read-only)	\??\i:	gbybufws.exe
File opened (read-only)	\??\l:	gbybufws.exe
File opened (read-only)	\??\q:	gbybufws.exe
File opened (read-only)	\??\i:	gbybufws.exe
File opened (read-only)	\??\e:	gbybufws.exe
File opened (read-only)	\??\r:	gbybufws.exe
File opened (read-only)	\??\s:	gbybufws.exe
File opened (read-only)	\??\o:	qfftdsqnrz.exe
File opened (read-only)	\??\a:	gbybufws.exe
File opened (read-only)	\??\h:	gbybufws.exe
File opened (read-only)	\??\v:	gbybufws.exe
File opened (read-only)	\??\k:	gbybufws.exe
File opened (read-only)	\??\m:	qfftdsqnrz.exe
File opened (read-only)	\??\b:	gbybufws.exe
File opened (read-only)	\??\h:	gbybufws.exe
File opened (read-only)	\??\w:	gbybufws.exe
File opened (read-only)	\??\m:	gbybufws.exe
File opened (read-only)	\??\u:	gbybufws.exe
File opened (read-only)	\??\z:	gbybufws.exe
File opened (read-only)	\??\g:	qfftdsqnrz.exe
File opened (read-only)	\??\k:	gbybufws.exe
File opened (read-only)	\??\y:	qfftdsqnrz.exe
File opened (read-only)	\??\j:	gbybufws.exe
File opened (read-only)	\??\q:	qfftdsqnrz.exe
File opened (read-only)	\??\t:	gbybufws.exe
File opened (read-only)	\??\t:	gbybufws.exe
File opened (read-only)	\??\u:	gbybufws.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

qfftdsqnrz.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	qfftdsqnrz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	qfftdsqnrz.exe

AutoIT Executable 13 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1184-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/820-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/672-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1088-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/676-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1184-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1184-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1548-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/820-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/672-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1088-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/676-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1548-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exeqfftdsqnrz.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\bhqziyhedvgtffn.exe	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
File created	C:\Windows\SysWOW64\gbybufws.exe	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
File opened for modification	C:\Windows\SysWOW64\gbybufws.exe	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
File created	C:\Windows\SysWOW64\pwhesomoahbzg.exe	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
File opened for modification	C:\Windows\SysWOW64\pwhesomoahbzg.exe	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	qfftdsqnrz.exe
File created	C:\Windows\SysWOW64\qfftdsqnrz.exe	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
File created	C:\Windows\SysWOW64\bhqziyhedvgtffn.exe	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
File opened for modification	C:\Windows\SysWOW64\qfftdsqnrz.exe	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe

Drops file in Program Files directory 15 IoCs

Processes:

gbybufws.exegbybufws.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	gbybufws.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	gbybufws.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	gbybufws.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	gbybufws.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	gbybufws.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	gbybufws.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	gbybufws.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	gbybufws.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	gbybufws.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	gbybufws.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	gbybufws.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	gbybufws.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	gbybufws.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	gbybufws.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	gbybufws.exe

Drops file in Windows directory 5 IoCs

Processes:

be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEqfftdsqnrz.exebe94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	qfftdsqnrz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	qfftdsqnrz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB5B12844E7399952CBBAD43392D4C5"	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	qfftdsqnrz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32422C7E9C5682206A4177D377272CA97CF565AA"	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	qfftdsqnrz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	qfftdsqnrz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACEFABCFE17F29383793A3186EC3994B08B038B4316023DE1C842E608A4"	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	qfftdsqnrz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	qfftdsqnrz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1552 WINWORD.EXE

pid	process
1552	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exebhqziyhedvgtffn.exeqfftdsqnrz.exepwhesomoahbzg.exegbybufws.exe

pid	process
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
820	qfftdsqnrz.exe
820	qfftdsqnrz.exe
820	qfftdsqnrz.exe
820	qfftdsqnrz.exe
820	qfftdsqnrz.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
1088	gbybufws.exe
1088	gbybufws.exe
1088	gbybufws.exe
1088	gbybufws.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
672	bhqziyhedvgtffn.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exebhqziyhedvgtffn.exeqfftdsqnrz.exegbybufws.exepwhesomoahbzg.exegbybufws.exe

pid	process
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
820	qfftdsqnrz.exe
820	qfftdsqnrz.exe
820	qfftdsqnrz.exe
1088	gbybufws.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
1088	gbybufws.exe
676	pwhesomoahbzg.exe
1088	gbybufws.exe
1548	gbybufws.exe
1548	gbybufws.exe
1548	gbybufws.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exebhqziyhedvgtffn.exeqfftdsqnrz.exegbybufws.exepwhesomoahbzg.exegbybufws.exe

pid	process
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
672	bhqziyhedvgtffn.exe
820	qfftdsqnrz.exe
820	qfftdsqnrz.exe
820	qfftdsqnrz.exe
1088	gbybufws.exe
676	pwhesomoahbzg.exe
676	pwhesomoahbzg.exe
1088	gbybufws.exe
676	pwhesomoahbzg.exe
1088	gbybufws.exe
1548	gbybufws.exe
1548	gbybufws.exe
1548	gbybufws.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1552 WINWORD.EXE
1552 WINWORD.EXE

pid	process
1552	WINWORD.EXE
1552	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exeqfftdsqnrz.exeWINWORD.EXE

description	pid	process	target process
PID 1184 wrote to memory of 820	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	qfftdsqnrz.exe
PID 1184 wrote to memory of 820	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	qfftdsqnrz.exe
PID 1184 wrote to memory of 820	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	qfftdsqnrz.exe
PID 1184 wrote to memory of 820	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	qfftdsqnrz.exe
PID 1184 wrote to memory of 672	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	bhqziyhedvgtffn.exe
PID 1184 wrote to memory of 672	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	bhqziyhedvgtffn.exe
PID 1184 wrote to memory of 672	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	bhqziyhedvgtffn.exe
PID 1184 wrote to memory of 672	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	bhqziyhedvgtffn.exe
PID 1184 wrote to memory of 1088	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	gbybufws.exe
PID 1184 wrote to memory of 1088	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	gbybufws.exe
PID 1184 wrote to memory of 1088	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	gbybufws.exe
PID 1184 wrote to memory of 1088	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	gbybufws.exe
PID 1184 wrote to memory of 676	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	pwhesomoahbzg.exe
PID 1184 wrote to memory of 676	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	pwhesomoahbzg.exe
PID 1184 wrote to memory of 676	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	pwhesomoahbzg.exe
PID 1184 wrote to memory of 676	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	pwhesomoahbzg.exe
PID 820 wrote to memory of 1548	820	qfftdsqnrz.exe	gbybufws.exe
PID 820 wrote to memory of 1548	820	qfftdsqnrz.exe	gbybufws.exe
PID 820 wrote to memory of 1548	820	qfftdsqnrz.exe	gbybufws.exe
PID 820 wrote to memory of 1548	820	qfftdsqnrz.exe	gbybufws.exe
PID 1184 wrote to memory of 1552	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	WINWORD.EXE
PID 1184 wrote to memory of 1552	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	WINWORD.EXE
PID 1184 wrote to memory of 1552	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	WINWORD.EXE
PID 1184 wrote to memory of 1552	1184	be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe	WINWORD.EXE
PID 1552 wrote to memory of 1600	1552	WINWORD.EXE	splwow64.exe
PID 1552 wrote to memory of 1600	1552	WINWORD.EXE	splwow64.exe
PID 1552 wrote to memory of 1600	1552	WINWORD.EXE	splwow64.exe
PID 1552 wrote to memory of 1600	1552	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe
"C:\Users\Admin\AppData\Local\Temp\be94ffd78be149ac7ba4b07446f812ddb14836ad99c32834f1a9baac2cfe9b26.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\qfftdsqnrz.exe
qfftdsqnrz.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\gbybufws.exe
C:\Windows\system32\gbybufws.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1548

C:\Windows\SysWOW64\bhqziyhedvgtffn.exe
bhqziyhedvgtffn.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:672

C:\Windows\SysWOW64\gbybufws.exe
gbybufws.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1088

C:\Windows\SysWOW64\pwhesomoahbzg.exe
pwhesomoahbzg.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:676

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
02fee1f677449aa05edae54107f50aa2

SHA1
60a5408d10fbe4b2d3d36d1541730e04ee8e5feb

SHA256
9b099fed263e2d2f17220a1b55a4767d9a4ce6e9046534f504aee602417e1a47

SHA512
e1a487693e4d069914ac94a75f80c87a1bff3c6ecc56322be813ee2e9586ca6bf954fd59c4a0452f748e5f2a758b364a3a7e81cb7644edc04b8086dc759ed7ed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
9410c493ab7e14b9afb5c876828714b8

SHA1
b6cd69e1f08b7dd6a0e5a1fa0dc69cad272c6a73

SHA256
ba904ef16b02a3a2e500ee95645fd73cd904cd570fbfe249303235265985b79f

SHA512
a0e8b24bc4a236dbdcc337dbdf518738364c77ba3982776285be02686076b2374ed56d4df985bc467e508f739d2e82458817a6aca59cf5b6d0704d6813834571

Download Submit
C:\Windows\SysWOW64\bhqziyhedvgtffn.exe

Filesize
255KB

MD5
2a241bf4031be00d1511c74a61438304

SHA1
6af13450d53cbbfde6f6982045b75ef88be618d3

SHA256
63571990b90a677dd7def91d094aabc57f141b988e7bb0390f7a4fdd06ed3b7d

SHA512
8190f7c0832a039b391073571cffcc0239dde7a9e72612dcde839211564fd120cd61628cb39a02fff4f5b17f6ab607f6aa6883651e7eec6519fa0b9d0dc69e19

Download Submit
C:\Windows\SysWOW64\bhqziyhedvgtffn.exe

Filesize
255KB

MD5
2a241bf4031be00d1511c74a61438304

SHA1
6af13450d53cbbfde6f6982045b75ef88be618d3

SHA256
63571990b90a677dd7def91d094aabc57f141b988e7bb0390f7a4fdd06ed3b7d

SHA512
8190f7c0832a039b391073571cffcc0239dde7a9e72612dcde839211564fd120cd61628cb39a02fff4f5b17f6ab607f6aa6883651e7eec6519fa0b9d0dc69e19

Download Submit
C:\Windows\SysWOW64\gbybufws.exe

Filesize
255KB

MD5
49ed3c67c395fc08f8194e5910b1a503

SHA1
94eab5e5544dc486234c90c625ae52ea22b42254

SHA256
fffb316b78496c4dd99e539d3c3ec3b6c605abbc825809d31e85c03414cfe0ef

SHA512
d22e79792306c7a1215de4fade06eb0cfa4babec792ec2cad5f9069de2d7ed098b16960a277b6cb7d4c0e5898f976413e90c14e0188d369af84a2ad074d5e0e0

Download Submit
C:\Windows\SysWOW64\gbybufws.exe

Filesize
255KB

MD5
49ed3c67c395fc08f8194e5910b1a503

SHA1
94eab5e5544dc486234c90c625ae52ea22b42254

SHA256
fffb316b78496c4dd99e539d3c3ec3b6c605abbc825809d31e85c03414cfe0ef

SHA512
d22e79792306c7a1215de4fade06eb0cfa4babec792ec2cad5f9069de2d7ed098b16960a277b6cb7d4c0e5898f976413e90c14e0188d369af84a2ad074d5e0e0

Download Submit
C:\Windows\SysWOW64\gbybufws.exe

Filesize
255KB

MD5
49ed3c67c395fc08f8194e5910b1a503

SHA1
94eab5e5544dc486234c90c625ae52ea22b42254

SHA256
fffb316b78496c4dd99e539d3c3ec3b6c605abbc825809d31e85c03414cfe0ef

SHA512
d22e79792306c7a1215de4fade06eb0cfa4babec792ec2cad5f9069de2d7ed098b16960a277b6cb7d4c0e5898f976413e90c14e0188d369af84a2ad074d5e0e0

Download Submit
C:\Windows\SysWOW64\pwhesomoahbzg.exe

Filesize
255KB

MD5
fe9835b157f4603120319ff3c47c4e4c

SHA1
47d925869ca68cf4e6069ed193167d118e26030b

SHA256
6a615920729a01dddd353adeab3a211a758e02bf93b0f11a63fa9847e3fe506e

SHA512
da670ab04aff7357c8ebdda81e49d009b0457e22b55134c79e77c7c8db2110b95136ea5f6843c1f695bb7e99e5eb041cac2930f76cd6923749954332a3d21e1c

Download Submit
C:\Windows\SysWOW64\pwhesomoahbzg.exe

Filesize
255KB

MD5
fe9835b157f4603120319ff3c47c4e4c

SHA1
47d925869ca68cf4e6069ed193167d118e26030b

SHA256
6a615920729a01dddd353adeab3a211a758e02bf93b0f11a63fa9847e3fe506e

SHA512
da670ab04aff7357c8ebdda81e49d009b0457e22b55134c79e77c7c8db2110b95136ea5f6843c1f695bb7e99e5eb041cac2930f76cd6923749954332a3d21e1c

Download Submit
C:\Windows\SysWOW64\qfftdsqnrz.exe

Filesize
255KB

MD5
392c04c61296a4d86fed5b80f2a235e4

SHA1
41ab950a1b2a64497a161fbe43846c525d88b8b9

SHA256
016aaf5222c2ad7e7dcbf47b9be8ea41b2d693c9294f0ab9adf4cc5a0db78fb4

SHA512
573f4f8c3042d5c0dde44ed891d0ee4c04f0debe0c9f08da9f6e55bb8b47c86c01964bdb0257a7442bf93fb4fc69e1f5d9828b2727afd868aac8a76407a3ff13

Download Submit
C:\Windows\SysWOW64\qfftdsqnrz.exe

Filesize
255KB

MD5
392c04c61296a4d86fed5b80f2a235e4

SHA1
41ab950a1b2a64497a161fbe43846c525d88b8b9

SHA256
016aaf5222c2ad7e7dcbf47b9be8ea41b2d693c9294f0ab9adf4cc5a0db78fb4

SHA512
573f4f8c3042d5c0dde44ed891d0ee4c04f0debe0c9f08da9f6e55bb8b47c86c01964bdb0257a7442bf93fb4fc69e1f5d9828b2727afd868aac8a76407a3ff13

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\bhqziyhedvgtffn.exe

Filesize
255KB

MD5
2a241bf4031be00d1511c74a61438304

SHA1
6af13450d53cbbfde6f6982045b75ef88be618d3

SHA256
63571990b90a677dd7def91d094aabc57f141b988e7bb0390f7a4fdd06ed3b7d

SHA512
8190f7c0832a039b391073571cffcc0239dde7a9e72612dcde839211564fd120cd61628cb39a02fff4f5b17f6ab607f6aa6883651e7eec6519fa0b9d0dc69e19

Download Submit
\Windows\SysWOW64\gbybufws.exe

Filesize
255KB

MD5
49ed3c67c395fc08f8194e5910b1a503

SHA1
94eab5e5544dc486234c90c625ae52ea22b42254

SHA256
fffb316b78496c4dd99e539d3c3ec3b6c605abbc825809d31e85c03414cfe0ef

SHA512
d22e79792306c7a1215de4fade06eb0cfa4babec792ec2cad5f9069de2d7ed098b16960a277b6cb7d4c0e5898f976413e90c14e0188d369af84a2ad074d5e0e0

Download Submit
\Windows\SysWOW64\gbybufws.exe

Filesize
255KB

MD5
49ed3c67c395fc08f8194e5910b1a503

SHA1
94eab5e5544dc486234c90c625ae52ea22b42254

SHA256
fffb316b78496c4dd99e539d3c3ec3b6c605abbc825809d31e85c03414cfe0ef

SHA512
d22e79792306c7a1215de4fade06eb0cfa4babec792ec2cad5f9069de2d7ed098b16960a277b6cb7d4c0e5898f976413e90c14e0188d369af84a2ad074d5e0e0

Download Submit
\Windows\SysWOW64\pwhesomoahbzg.exe

Filesize
255KB

MD5
fe9835b157f4603120319ff3c47c4e4c

SHA1
47d925869ca68cf4e6069ed193167d118e26030b

SHA256
6a615920729a01dddd353adeab3a211a758e02bf93b0f11a63fa9847e3fe506e

SHA512
da670ab04aff7357c8ebdda81e49d009b0457e22b55134c79e77c7c8db2110b95136ea5f6843c1f695bb7e99e5eb041cac2930f76cd6923749954332a3d21e1c

Download Submit
\Windows\SysWOW64\qfftdsqnrz.exe

Filesize
255KB

MD5
392c04c61296a4d86fed5b80f2a235e4

SHA1
41ab950a1b2a64497a161fbe43846c525d88b8b9

SHA256
016aaf5222c2ad7e7dcbf47b9be8ea41b2d693c9294f0ab9adf4cc5a0db78fb4

SHA512
573f4f8c3042d5c0dde44ed891d0ee4c04f0debe0c9f08da9f6e55bb8b47c86c01964bdb0257a7442bf93fb4fc69e1f5d9828b2727afd868aac8a76407a3ff13

Download Submit
memory/672-61-0x0000000000000000-mapping.dmp

Download
memory/672-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/672-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/676-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/676-70-0x0000000000000000-mapping.dmp

Download
memory/676-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/820-58-0x0000000000000000-mapping.dmp

Download
memory/820-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/820-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1088-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1088-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1088-64-0x0000000000000000-mapping.dmp

Download
memory/1184-80-0x00000000023B0000-0x0000000002450000-memory.dmp

Filesize
640KB

Download
memory/1184-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1184-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1184-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1184-57-0x00000000023B0000-0x0000000002450000-memory.dmp

Filesize
640KB

Download
memory/1184-78-0x00000000023B0000-0x0000000002450000-memory.dmp

Filesize
640KB

Download
memory/1184-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1548-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1548-85-0x0000000000000000-mapping.dmp

Download
memory/1548-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1552-96-0x000000006FD31000-0x000000006FD33000-memory.dmp

Filesize
8KB

Download
memory/1552-100-0x0000000070D1D000-0x0000000070D28000-memory.dmp

Filesize
44KB

Download
memory/1552-98-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1552-102-0x0000000070D1D000-0x0000000070D28000-memory.dmp

Filesize
44KB

Download
memory/1552-90-0x00000000722B1000-0x00000000722B4000-memory.dmp

Filesize
12KB

Download
memory/1552-88-0x0000000000000000-mapping.dmp

Download
memory/1552-107-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1552-108-0x0000000070D1D000-0x0000000070D28000-memory.dmp

Filesize
44KB

Download
memory/1600-103-0x0000000000000000-mapping.dmp

Download
memory/1600-104-0x000007FEFB7C1000-0x000007FEFB7C3000-memory.dmp

Filesize
8KB

Download