a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64

Analysis

max time kernel
153s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
Size

255KB
MD5

e7fc13d75c743f69e760ba100d4cc561
SHA1

1d99f33a8e4d570a7a209fb9f9fabda31a28b4e6
SHA256

a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64
SHA512

1b8842dcf7d358a42dc95e275f2a59e6e3da0947b938512d9c31ffaf85564c8de49d6d1351ad97e49fc8786d41ab04a2dc0bcb388a25018a8b1f48e7dcd6afb8
SSDEEP

6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6z:Plf5j6zCNa0xeE3mG

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

kicznvexqp.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	kicznvexqp.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

kicznvexqp.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kicznvexqp.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

kicznvexqp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	kicznvexqp.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

kicznvexqp.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kicznvexqp.exe

Executes dropped EXE 5 IoCs

Processes:

kicznvexqp.exezmfxhbuucijzhme.exenubrtdzb.exemffuxeudunawq.exenubrtdzb.exe

pid process

944 kicznvexqp.exe
1356 zmfxhbuucijzhme.exe
1100 nubrtdzb.exe
2024 mffuxeudunawq.exe
796 nubrtdzb.exe

pid	process
944	kicznvexqp.exe
1356	zmfxhbuucijzhme.exe
1100	nubrtdzb.exe
2024	mffuxeudunawq.exe
796	nubrtdzb.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2016-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\kicznvexqp.exe	upx
C:\Windows\SysWOW64\kicznvexqp.exe	upx
C:\Windows\SysWOW64\kicznvexqp.exe	upx
\Windows\SysWOW64\zmfxhbuucijzhme.exe	upx
C:\Windows\SysWOW64\zmfxhbuucijzhme.exe	upx
C:\Windows\SysWOW64\zmfxhbuucijzhme.exe	upx
\Windows\SysWOW64\nubrtdzb.exe	upx
C:\Windows\SysWOW64\nubrtdzb.exe	upx
\Windows\SysWOW64\mffuxeudunawq.exe	upx
C:\Windows\SysWOW64\nubrtdzb.exe	upx
C:\Windows\SysWOW64\mffuxeudunawq.exe	upx
behavioral1/memory/944-76-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1356-78-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1100-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2024-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\mffuxeudunawq.exe	upx
behavioral1/memory/2016-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1356-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1100-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/2024-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\nubrtdzb.exe	upx
C:\Windows\SysWOW64\nubrtdzb.exe	upx
behavioral1/memory/2016-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/796-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/796-103-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files\WaitUnblock.doc.exe	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	upx

Loads dropped DLL 5 IoCs

Processes:

a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exekicznvexqp.exe

pid	process
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
944	kicznvexqp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

kicznvexqp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	kicznvexqp.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zmfxhbuucijzhme.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	zmfxhbuucijzhme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dugkbooo = "kicznvexqp.exe"	zmfxhbuucijzhme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hebrpzjs = "zmfxhbuucijzhme.exe"	zmfxhbuucijzhme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mffuxeudunawq.exe"	zmfxhbuucijzhme.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

nubrtdzb.exenubrtdzb.exekicznvexqp.exe

description	ioc	process
File opened (read-only)	\??\s:	nubrtdzb.exe
File opened (read-only)	\??\u:	nubrtdzb.exe
File opened (read-only)	\??\i:	nubrtdzb.exe
File opened (read-only)	\??\o:	nubrtdzb.exe
File opened (read-only)	\??\u:	nubrtdzb.exe
File opened (read-only)	\??\e:	kicznvexqp.exe
File opened (read-only)	\??\m:	kicznvexqp.exe
File opened (read-only)	\??\o:	kicznvexqp.exe
File opened (read-only)	\??\m:	nubrtdzb.exe
File opened (read-only)	\??\p:	kicznvexqp.exe
File opened (read-only)	\??\v:	kicznvexqp.exe
File opened (read-only)	\??\f:	nubrtdzb.exe
File opened (read-only)	\??\q:	nubrtdzb.exe
File opened (read-only)	\??\q:	nubrtdzb.exe
File opened (read-only)	\??\v:	nubrtdzb.exe
File opened (read-only)	\??\e:	nubrtdzb.exe
File opened (read-only)	\??\t:	nubrtdzb.exe
File opened (read-only)	\??\z:	kicznvexqp.exe
File opened (read-only)	\??\e:	nubrtdzb.exe
File opened (read-only)	\??\r:	nubrtdzb.exe
File opened (read-only)	\??\y:	nubrtdzb.exe
File opened (read-only)	\??\t:	kicznvexqp.exe
File opened (read-only)	\??\f:	nubrtdzb.exe
File opened (read-only)	\??\o:	nubrtdzb.exe
File opened (read-only)	\??\p:	nubrtdzb.exe
File opened (read-only)	\??\w:	nubrtdzb.exe
File opened (read-only)	\??\x:	nubrtdzb.exe
File opened (read-only)	\??\i:	kicznvexqp.exe
File opened (read-only)	\??\k:	kicznvexqp.exe
File opened (read-only)	\??\r:	kicznvexqp.exe
File opened (read-only)	\??\h:	nubrtdzb.exe
File opened (read-only)	\??\x:	nubrtdzb.exe
File opened (read-only)	\??\z:	nubrtdzb.exe
File opened (read-only)	\??\w:	nubrtdzb.exe
File opened (read-only)	\??\b:	kicznvexqp.exe
File opened (read-only)	\??\a:	nubrtdzb.exe
File opened (read-only)	\??\g:	nubrtdzb.exe
File opened (read-only)	\??\j:	nubrtdzb.exe
File opened (read-only)	\??\l:	nubrtdzb.exe
File opened (read-only)	\??\j:	nubrtdzb.exe
File opened (read-only)	\??\j:	kicznvexqp.exe
File opened (read-only)	\??\w:	kicznvexqp.exe
File opened (read-only)	\??\x:	kicznvexqp.exe
File opened (read-only)	\??\k:	nubrtdzb.exe
File opened (read-only)	\??\a:	nubrtdzb.exe
File opened (read-only)	\??\k:	nubrtdzb.exe
File opened (read-only)	\??\u:	kicznvexqp.exe
File opened (read-only)	\??\m:	nubrtdzb.exe
File opened (read-only)	\??\b:	nubrtdzb.exe
File opened (read-only)	\??\p:	nubrtdzb.exe
File opened (read-only)	\??\f:	kicznvexqp.exe
File opened (read-only)	\??\l:	kicznvexqp.exe
File opened (read-only)	\??\t:	nubrtdzb.exe
File opened (read-only)	\??\l:	nubrtdzb.exe
File opened (read-only)	\??\z:	nubrtdzb.exe
File opened (read-only)	\??\q:	kicznvexqp.exe
File opened (read-only)	\??\b:	nubrtdzb.exe
File opened (read-only)	\??\i:	nubrtdzb.exe
File opened (read-only)	\??\r:	nubrtdzb.exe
File opened (read-only)	\??\s:	nubrtdzb.exe
File opened (read-only)	\??\n:	kicznvexqp.exe
File opened (read-only)	\??\y:	kicznvexqp.exe
File opened (read-only)	\??\h:	nubrtdzb.exe
File opened (read-only)	\??\n:	nubrtdzb.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

kicznvexqp.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	kicznvexqp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	kicznvexqp.exe

AutoIT Executable 17 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2016-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2016-75-0x0000000002F30000-0x0000000002FD0000-memory.dmp	autoit_exe
behavioral1/memory/944-76-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2016-77-0x0000000002F30000-0x0000000002FD0000-memory.dmp	autoit_exe
behavioral1/memory/1356-78-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1100-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2016-80-0x0000000002F30000-0x0000000002FD0000-memory.dmp	autoit_exe
behavioral1/memory/2024-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2016-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1356-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1100-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2024-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/2016-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/944-97-0x0000000003840000-0x00000000038E0000-memory.dmp	autoit_exe
behavioral1/memory/796-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/944-102-0x0000000003840000-0x00000000038E0000-memory.dmp	autoit_exe
behavioral1/memory/796-103-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exekicznvexqp.exe

description	ioc	process
File created	C:\Windows\SysWOW64\kicznvexqp.exe	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
File opened for modification	C:\Windows\SysWOW64\zmfxhbuucijzhme.exe	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
File created	C:\Windows\SysWOW64\nubrtdzb.exe	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
File opened for modification	C:\Windows\SysWOW64\nubrtdzb.exe	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
File opened for modification	C:\Windows\SysWOW64\mffuxeudunawq.exe	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
File opened for modification	C:\Windows\SysWOW64\kicznvexqp.exe	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
File created	C:\Windows\SysWOW64\zmfxhbuucijzhme.exe	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
File created	C:\Windows\SysWOW64\mffuxeudunawq.exe	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	kicznvexqp.exe

Drops file in Program Files directory 22 IoCs

Processes:

nubrtdzb.exenubrtdzb.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nubrtdzb.exe
File opened for modification	C:\Program Files\WaitUnblock.nal	nubrtdzb.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nubrtdzb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	nubrtdzb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nubrtdzb.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nubrtdzb.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nubrtdzb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	nubrtdzb.exe
File created	\??\c:\Program Files\WaitUnblock.doc.exe	nubrtdzb.exe
File opened for modification	C:\Program Files\WaitUnblock.doc.exe	nubrtdzb.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nubrtdzb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	nubrtdzb.exe
File created	\??\c:\Program Files\WaitUnblock.doc.exe	nubrtdzb.exe
File opened for modification	\??\c:\Program Files\WaitUnblock.doc.exe	nubrtdzb.exe
File opened for modification	C:\Program Files\WaitUnblock.nal	nubrtdzb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	nubrtdzb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nubrtdzb.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nubrtdzb.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	nubrtdzb.exe
File opened for modification	\??\c:\Program Files\WaitUnblock.doc.exe	nubrtdzb.exe
File opened for modification	C:\Program Files\WaitUnblock.doc.exe	nubrtdzb.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	nubrtdzb.exe

Drops file in Windows directory 5 IoCs

Processes:

a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEa664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exekicznvexqp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFFAB9F96BF29183783B43819E3E94B08C02FD43620233E1BD42ED08D6"	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	kicznvexqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	kicznvexqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	kicznvexqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	kicznvexqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	kicznvexqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C67415E0DBC0B9BB7F97ED9437CA"	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	kicznvexqp.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

772 WINWORD.EXE

pid	process
772	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exekicznvexqp.exezmfxhbuucijzhme.exenubrtdzb.exemffuxeudunawq.exe

pid	process
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
944	kicznvexqp.exe
944	kicznvexqp.exe
944	kicznvexqp.exe
944	kicznvexqp.exe
944	kicznvexqp.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1100	nubrtdzb.exe
1100	nubrtdzb.exe
1100	nubrtdzb.exe
1100	nubrtdzb.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
1356	zmfxhbuucijzhme.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
1356	zmfxhbuucijzhme.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exekicznvexqp.exezmfxhbuucijzhme.exenubrtdzb.exemffuxeudunawq.exenubrtdzb.exe

pid	process
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
944	kicznvexqp.exe
944	kicznvexqp.exe
944	kicznvexqp.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1100	nubrtdzb.exe
1100	nubrtdzb.exe
1100	nubrtdzb.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
796	nubrtdzb.exe
796	nubrtdzb.exe
796	nubrtdzb.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exekicznvexqp.exezmfxhbuucijzhme.exenubrtdzb.exemffuxeudunawq.exenubrtdzb.exe

pid	process
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
944	kicznvexqp.exe
944	kicznvexqp.exe
944	kicznvexqp.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1356	zmfxhbuucijzhme.exe
1100	nubrtdzb.exe
1100	nubrtdzb.exe
1100	nubrtdzb.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
2024	mffuxeudunawq.exe
796	nubrtdzb.exe
796	nubrtdzb.exe
796	nubrtdzb.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

772 WINWORD.EXE
772 WINWORD.EXE

pid	process
772	WINWORD.EXE
772	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exekicznvexqp.exeWINWORD.EXE

description	pid	process	target process
PID 2016 wrote to memory of 944	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	kicznvexqp.exe
PID 2016 wrote to memory of 944	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	kicznvexqp.exe
PID 2016 wrote to memory of 944	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	kicznvexqp.exe
PID 2016 wrote to memory of 944	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	kicznvexqp.exe
PID 2016 wrote to memory of 1356	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	zmfxhbuucijzhme.exe
PID 2016 wrote to memory of 1356	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	zmfxhbuucijzhme.exe
PID 2016 wrote to memory of 1356	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	zmfxhbuucijzhme.exe
PID 2016 wrote to memory of 1356	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	zmfxhbuucijzhme.exe
PID 2016 wrote to memory of 1100	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	nubrtdzb.exe
PID 2016 wrote to memory of 1100	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	nubrtdzb.exe
PID 2016 wrote to memory of 1100	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	nubrtdzb.exe
PID 2016 wrote to memory of 1100	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	nubrtdzb.exe
PID 2016 wrote to memory of 2024	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	mffuxeudunawq.exe
PID 2016 wrote to memory of 2024	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	mffuxeudunawq.exe
PID 2016 wrote to memory of 2024	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	mffuxeudunawq.exe
PID 2016 wrote to memory of 2024	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	mffuxeudunawq.exe
PID 944 wrote to memory of 796	944	kicznvexqp.exe	nubrtdzb.exe
PID 944 wrote to memory of 796	944	kicznvexqp.exe	nubrtdzb.exe
PID 944 wrote to memory of 796	944	kicznvexqp.exe	nubrtdzb.exe
PID 944 wrote to memory of 796	944	kicznvexqp.exe	nubrtdzb.exe
PID 2016 wrote to memory of 772	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	WINWORD.EXE
PID 2016 wrote to memory of 772	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	WINWORD.EXE
PID 2016 wrote to memory of 772	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	WINWORD.EXE
PID 2016 wrote to memory of 772	2016	a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe	WINWORD.EXE
PID 772 wrote to memory of 824	772	WINWORD.EXE	splwow64.exe
PID 772 wrote to memory of 824	772	WINWORD.EXE	splwow64.exe
PID 772 wrote to memory of 824	772	WINWORD.EXE	splwow64.exe
PID 772 wrote to memory of 824	772	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe
"C:\Users\Admin\AppData\Local\Temp\a664a7b3b9f1106875fd6b148a08ff8fc272c74c6e91eefc1739aad74497cb64.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\kicznvexqp.exe
kicznvexqp.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\nubrtdzb.exe
C:\Windows\system32\nubrtdzb.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:796

C:\Windows\SysWOW64\zmfxhbuucijzhme.exe
zmfxhbuucijzhme.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1356

C:\Windows\SysWOW64\nubrtdzb.exe
nubrtdzb.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1100

C:\Windows\SysWOW64\mffuxeudunawq.exe
mffuxeudunawq.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2024

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
abf241d20190ae6238fee0eab4420438

SHA1
3daf8186a4902a0e0838d4a53cbc69ad98687fac

SHA256
fbbea50ce7556c8ecb7518a981351c917004f675d0662669904cdab8448cdff8

SHA512
d01f7378916ed356ec3fde77a47bcad6322a64c1ed49d8115d2ad8d0573641d7308b1ad30b8b2fcb9d0fa0ddc1dc70048961ed0828c897b1c7d0c36dae9f16b3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
92470a763e1d7b7bc20163edce5aaf2e

SHA1
ecb011a87fd5ccb5064c251889bf2a55366bdcf2

SHA256
934b05fbeac25600f87806cb9b9ac2f6476ee5eff58802219565241048cab9a9

SHA512
23e28b98028291e93aa1845a9e7ea7253058de03d9ae53aea8bbd88ddfb7ec275b916b7c34624009fe37e93dd3aa532e89637aaaeabfdeb5dd987b1cbccf0f15

Download Submit
C:\Program Files\WaitUnblock.doc.exe

Filesize
255KB

MD5
ed85872c4b92dbaf21d4cfec2c69ef4e

SHA1
21d976fc236939d9bc62b7cf06f8268ab7f6172f

SHA256
cca23241d9f352e93ce1cdba4cd6e0ec350afdfe8e0a59247c11a5d6f595918c

SHA512
de711584e1779dcd70d167ee70b2ebb8fa88da6a509c6a3650598939c1710f575bc835f743aa4514a8f4daaab4f19252762290474bf83e7bb6d3bbfceb60a996

Download Submit
C:\Windows\SysWOW64\kicznvexqp.exe

Filesize
255KB

MD5
92470a763e1d7b7bc20163edce5aaf2e

SHA1
ecb011a87fd5ccb5064c251889bf2a55366bdcf2

SHA256
934b05fbeac25600f87806cb9b9ac2f6476ee5eff58802219565241048cab9a9

SHA512
23e28b98028291e93aa1845a9e7ea7253058de03d9ae53aea8bbd88ddfb7ec275b916b7c34624009fe37e93dd3aa532e89637aaaeabfdeb5dd987b1cbccf0f15

Download Submit
C:\Windows\SysWOW64\kicznvexqp.exe

Filesize
255KB

MD5
92470a763e1d7b7bc20163edce5aaf2e

SHA1
ecb011a87fd5ccb5064c251889bf2a55366bdcf2

SHA256
934b05fbeac25600f87806cb9b9ac2f6476ee5eff58802219565241048cab9a9

SHA512
23e28b98028291e93aa1845a9e7ea7253058de03d9ae53aea8bbd88ddfb7ec275b916b7c34624009fe37e93dd3aa532e89637aaaeabfdeb5dd987b1cbccf0f15

Download Submit
C:\Windows\SysWOW64\mffuxeudunawq.exe

Filesize
255KB

MD5
ecfcd067c1567714beb001177897fc2f

SHA1
37cdea9b714d32cf425713799c85887fe93ce22c

SHA256
b973824157af2352fbabf0336fb393da240c2acf916f057a42234ee446e19db6

SHA512
00d802be2a83fbde15301380637dca7b9e3fa28803c6221d35c0235eb71aabc63e685dc5945abcd81cd72a315a9a6d644f455c72e48e93d3c80e99febb97caf8

Download Submit
C:\Windows\SysWOW64\mffuxeudunawq.exe

Filesize
255KB

MD5
ecfcd067c1567714beb001177897fc2f

SHA1
37cdea9b714d32cf425713799c85887fe93ce22c

SHA256
b973824157af2352fbabf0336fb393da240c2acf916f057a42234ee446e19db6

SHA512
00d802be2a83fbde15301380637dca7b9e3fa28803c6221d35c0235eb71aabc63e685dc5945abcd81cd72a315a9a6d644f455c72e48e93d3c80e99febb97caf8

Download Submit
C:\Windows\SysWOW64\nubrtdzb.exe

Filesize
255KB

MD5
893782aad0703a72067bca1bc516e071

SHA1
878d029a34287998374d8c0349015fb0ab642f9d

SHA256
d9426f98c90294922a0c23836d91b1c5891a14788e50bbc0d691c866925b5dcd

SHA512
df2d94fa51cebabf19394c3f94703b25faf2c2e9b069e18106c60ce9566b05bd66b0cda56043871c34df6150fe8a5ab6e9a4cd406b3a5abd68a55615ffae2316

Download Submit
C:\Windows\SysWOW64\nubrtdzb.exe

Filesize
255KB

MD5
893782aad0703a72067bca1bc516e071

SHA1
878d029a34287998374d8c0349015fb0ab642f9d

SHA256
d9426f98c90294922a0c23836d91b1c5891a14788e50bbc0d691c866925b5dcd

SHA512
df2d94fa51cebabf19394c3f94703b25faf2c2e9b069e18106c60ce9566b05bd66b0cda56043871c34df6150fe8a5ab6e9a4cd406b3a5abd68a55615ffae2316

Download Submit
C:\Windows\SysWOW64\nubrtdzb.exe

Filesize
255KB

MD5
893782aad0703a72067bca1bc516e071

SHA1
878d029a34287998374d8c0349015fb0ab642f9d

SHA256
d9426f98c90294922a0c23836d91b1c5891a14788e50bbc0d691c866925b5dcd

SHA512
df2d94fa51cebabf19394c3f94703b25faf2c2e9b069e18106c60ce9566b05bd66b0cda56043871c34df6150fe8a5ab6e9a4cd406b3a5abd68a55615ffae2316

Download Submit
C:\Windows\SysWOW64\zmfxhbuucijzhme.exe

Filesize
255KB

MD5
5c1166e17debf655ab6704c3e96f85fa

SHA1
fdc31c38a36f89a3ced87066a86fc3c0fac36559

SHA256
3e693505864b2272fa2a778db14d04d6eb4e13c96f75723a9b787a13fc7dab70

SHA512
ce75d1e8262f8d980dd699bf5e1937e38482c060d261884dc550ac5a140a0d69b426338bced847ee72fbd9e2ba1513b33399f829210e485409a308a99f95335e

Download Submit
C:\Windows\SysWOW64\zmfxhbuucijzhme.exe

Filesize
255KB

MD5
5c1166e17debf655ab6704c3e96f85fa

SHA1
fdc31c38a36f89a3ced87066a86fc3c0fac36559

SHA256
3e693505864b2272fa2a778db14d04d6eb4e13c96f75723a9b787a13fc7dab70

SHA512
ce75d1e8262f8d980dd699bf5e1937e38482c060d261884dc550ac5a140a0d69b426338bced847ee72fbd9e2ba1513b33399f829210e485409a308a99f95335e

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\kicznvexqp.exe

Filesize
255KB

MD5
92470a763e1d7b7bc20163edce5aaf2e

SHA1
ecb011a87fd5ccb5064c251889bf2a55366bdcf2

SHA256
934b05fbeac25600f87806cb9b9ac2f6476ee5eff58802219565241048cab9a9

SHA512
23e28b98028291e93aa1845a9e7ea7253058de03d9ae53aea8bbd88ddfb7ec275b916b7c34624009fe37e93dd3aa532e89637aaaeabfdeb5dd987b1cbccf0f15

Download Submit
\Windows\SysWOW64\mffuxeudunawq.exe

Filesize
255KB

MD5
ecfcd067c1567714beb001177897fc2f

SHA1
37cdea9b714d32cf425713799c85887fe93ce22c

SHA256
b973824157af2352fbabf0336fb393da240c2acf916f057a42234ee446e19db6

SHA512
00d802be2a83fbde15301380637dca7b9e3fa28803c6221d35c0235eb71aabc63e685dc5945abcd81cd72a315a9a6d644f455c72e48e93d3c80e99febb97caf8

Download Submit
\Windows\SysWOW64\nubrtdzb.exe

Filesize
255KB

MD5
893782aad0703a72067bca1bc516e071

SHA1
878d029a34287998374d8c0349015fb0ab642f9d

SHA256
d9426f98c90294922a0c23836d91b1c5891a14788e50bbc0d691c866925b5dcd

SHA512
df2d94fa51cebabf19394c3f94703b25faf2c2e9b069e18106c60ce9566b05bd66b0cda56043871c34df6150fe8a5ab6e9a4cd406b3a5abd68a55615ffae2316

Download Submit
\Windows\SysWOW64\nubrtdzb.exe

Filesize
255KB

MD5
893782aad0703a72067bca1bc516e071

SHA1
878d029a34287998374d8c0349015fb0ab642f9d

SHA256
d9426f98c90294922a0c23836d91b1c5891a14788e50bbc0d691c866925b5dcd

SHA512
df2d94fa51cebabf19394c3f94703b25faf2c2e9b069e18106c60ce9566b05bd66b0cda56043871c34df6150fe8a5ab6e9a4cd406b3a5abd68a55615ffae2316

Download Submit
\Windows\SysWOW64\zmfxhbuucijzhme.exe

Filesize
255KB

MD5
5c1166e17debf655ab6704c3e96f85fa

SHA1
fdc31c38a36f89a3ced87066a86fc3c0fac36559

SHA256
3e693505864b2272fa2a778db14d04d6eb4e13c96f75723a9b787a13fc7dab70

SHA512
ce75d1e8262f8d980dd699bf5e1937e38482c060d261884dc550ac5a140a0d69b426338bced847ee72fbd9e2ba1513b33399f829210e485409a308a99f95335e

Download Submit
memory/772-101-0x000000007176D000-0x0000000071778000-memory.dmp

Filesize
44KB

Download
memory/772-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/772-95-0x0000000070781000-0x0000000070783000-memory.dmp

Filesize
8KB

Download
memory/772-94-0x0000000072D01000-0x0000000072D04000-memory.dmp

Filesize
12KB

Download
memory/772-92-0x0000000000000000-mapping.dmp

Download
memory/796-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/796-103-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/796-89-0x0000000000000000-mapping.dmp

Download
memory/824-106-0x000007FEFC211000-0x000007FEFC213000-memory.dmp

Filesize
8KB

Download
memory/824-105-0x0000000000000000-mapping.dmp

Download
memory/944-97-0x0000000003840000-0x00000000038E0000-memory.dmp

Filesize
640KB

Download
memory/944-57-0x0000000000000000-mapping.dmp

Download
memory/944-102-0x0000000003840000-0x00000000038E0000-memory.dmp

Filesize
640KB

Download
memory/944-76-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1100-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1100-67-0x0000000000000000-mapping.dmp

Download
memory/1100-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1356-78-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1356-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1356-62-0x0000000000000000-mapping.dmp

Download
memory/2016-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2016-77-0x0000000002F30000-0x0000000002FD0000-memory.dmp

Filesize
640KB

Download
memory/2016-80-0x0000000002F30000-0x0000000002FD0000-memory.dmp

Filesize
640KB

Download
memory/2016-75-0x0000000002F30000-0x0000000002FD0000-memory.dmp

Filesize
640KB

Download
memory/2016-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2016-54-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/2016-84-0x0000000002F30000-0x0000000002FD0000-memory.dmp

Filesize
640KB

Download
memory/2016-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2024-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2024-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2024-71-0x0000000000000000-mapping.dmp

Download