8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a

Analysis

max time kernel
151s
max time network
75s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
Size

255KB
MD5

66b9fd5d2ac3edd2f6d8c5a97973dfa9
SHA1

ace7be4bf532a8f3a8176f441091a634ab2285a6
SHA256

8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a
SHA512

6e3df020a055c6583d84f140f46a5a64fb8e0427a652ff0720341e1593b6279162dac660597c92e85347f310b522ea0a64a76a7f987930b1e5267668a5beb908
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ+:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIv

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

cgcaluezfu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cgcaluezfu.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

cgcaluezfu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cgcaluezfu.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

cgcaluezfu.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	cgcaluezfu.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

cgcaluezfu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cgcaluezfu.exe

Executes dropped EXE 5 IoCs

Processes:

cgcaluezfu.exeebbozcullxfeugp.exeeptsttij.exeoqkyysfglyffu.exeeptsttij.exe

pid process

1080 cgcaluezfu.exe
544 ebbozcullxfeugp.exe
680 eptsttij.exe
1496 oqkyysfglyffu.exe
768 eptsttij.exe

pid	process
1080	cgcaluezfu.exe
544	ebbozcullxfeugp.exe
680	eptsttij.exe
1496	oqkyysfglyffu.exe
768	eptsttij.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1352-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\cgcaluezfu.exe	upx
C:\Windows\SysWOW64\cgcaluezfu.exe	upx
\Windows\SysWOW64\ebbozcullxfeugp.exe	upx
C:\Windows\SysWOW64\cgcaluezfu.exe	upx
C:\Windows\SysWOW64\ebbozcullxfeugp.exe	upx
\Windows\SysWOW64\eptsttij.exe	upx
C:\Windows\SysWOW64\oqkyysfglyffu.exe	upx
C:\Windows\SysWOW64\eptsttij.exe	upx
\Windows\SysWOW64\oqkyysfglyffu.exe	upx
C:\Windows\SysWOW64\oqkyysfglyffu.exe	upx
C:\Windows\SysWOW64\ebbozcullxfeugp.exe	upx
C:\Windows\SysWOW64\eptsttij.exe	upx
\Windows\SysWOW64\eptsttij.exe	upx
C:\Windows\SysWOW64\eptsttij.exe	upx
behavioral1/memory/1352-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1080-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/544-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/680-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1496-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/768-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1080-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/544-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/680-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1496-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/768-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	upx
\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	upx
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	upx

Loads dropped DLL 5 IoCs

Processes:

8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.execgcaluezfu.exe

pid	process
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1080	cgcaluezfu.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

cgcaluezfu.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	cgcaluezfu.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ebbozcullxfeugp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "oqkyysfglyffu.exe"	ebbozcullxfeugp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ebbozcullxfeugp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zupwmfzj = "cgcaluezfu.exe"	ebbozcullxfeugp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ztivahmq = "ebbozcullxfeugp.exe"	ebbozcullxfeugp.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cgcaluezfu.exeeptsttij.exeeptsttij.exe

description	ioc	process
File opened (read-only)	\??\r:	cgcaluezfu.exe
File opened (read-only)	\??\l:	eptsttij.exe
File opened (read-only)	\??\q:	cgcaluezfu.exe
File opened (read-only)	\??\q:	eptsttij.exe
File opened (read-only)	\??\j:	cgcaluezfu.exe
File opened (read-only)	\??\l:	cgcaluezfu.exe
File opened (read-only)	\??\p:	cgcaluezfu.exe
File opened (read-only)	\??\m:	eptsttij.exe
File opened (read-only)	\??\o:	eptsttij.exe
File opened (read-only)	\??\k:	cgcaluezfu.exe
File opened (read-only)	\??\a:	eptsttij.exe
File opened (read-only)	\??\g:	eptsttij.exe
File opened (read-only)	\??\n:	eptsttij.exe
File opened (read-only)	\??\u:	eptsttij.exe
File opened (read-only)	\??\z:	eptsttij.exe
File opened (read-only)	\??\u:	eptsttij.exe
File opened (read-only)	\??\z:	eptsttij.exe
File opened (read-only)	\??\b:	eptsttij.exe
File opened (read-only)	\??\t:	cgcaluezfu.exe
File opened (read-only)	\??\h:	eptsttij.exe
File opened (read-only)	\??\e:	eptsttij.exe
File opened (read-only)	\??\v:	eptsttij.exe
File opened (read-only)	\??\x:	eptsttij.exe
File opened (read-only)	\??\w:	eptsttij.exe
File opened (read-only)	\??\k:	eptsttij.exe
File opened (read-only)	\??\n:	eptsttij.exe
File opened (read-only)	\??\q:	eptsttij.exe
File opened (read-only)	\??\s:	eptsttij.exe
File opened (read-only)	\??\x:	cgcaluezfu.exe
File opened (read-only)	\??\y:	eptsttij.exe
File opened (read-only)	\??\u:	cgcaluezfu.exe
File opened (read-only)	\??\b:	eptsttij.exe
File opened (read-only)	\??\i:	eptsttij.exe
File opened (read-only)	\??\j:	eptsttij.exe
File opened (read-only)	\??\p:	eptsttij.exe
File opened (read-only)	\??\g:	eptsttij.exe
File opened (read-only)	\??\h:	cgcaluezfu.exe
File opened (read-only)	\??\r:	eptsttij.exe
File opened (read-only)	\??\p:	eptsttij.exe
File opened (read-only)	\??\v:	eptsttij.exe
File opened (read-only)	\??\b:	cgcaluezfu.exe
File opened (read-only)	\??\m:	cgcaluezfu.exe
File opened (read-only)	\??\n:	cgcaluezfu.exe
File opened (read-only)	\??\o:	cgcaluezfu.exe
File opened (read-only)	\??\s:	cgcaluezfu.exe
File opened (read-only)	\??\a:	eptsttij.exe
File opened (read-only)	\??\j:	eptsttij.exe
File opened (read-only)	\??\f:	cgcaluezfu.exe
File opened (read-only)	\??\t:	eptsttij.exe
File opened (read-only)	\??\i:	eptsttij.exe
File opened (read-only)	\??\s:	eptsttij.exe
File opened (read-only)	\??\t:	eptsttij.exe
File opened (read-only)	\??\g:	cgcaluezfu.exe
File opened (read-only)	\??\z:	cgcaluezfu.exe
File opened (read-only)	\??\o:	eptsttij.exe
File opened (read-only)	\??\y:	eptsttij.exe
File opened (read-only)	\??\h:	eptsttij.exe
File opened (read-only)	\??\l:	eptsttij.exe
File opened (read-only)	\??\v:	cgcaluezfu.exe
File opened (read-only)	\??\w:	cgcaluezfu.exe
File opened (read-only)	\??\k:	eptsttij.exe
File opened (read-only)	\??\f:	eptsttij.exe
File opened (read-only)	\??\i:	cgcaluezfu.exe
File opened (read-only)	\??\e:	cgcaluezfu.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

cgcaluezfu.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	cgcaluezfu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	cgcaluezfu.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1352-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1352-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1080-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/544-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/680-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1496-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/768-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1080-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/544-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/680-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1496-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/768-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.execgcaluezfu.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\cgcaluezfu.exe	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
File opened for modification	C:\Windows\SysWOW64\eptsttij.exe	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
File created	C:\Windows\SysWOW64\oqkyysfglyffu.exe	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
File opened for modification	C:\Windows\SysWOW64\oqkyysfglyffu.exe	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	cgcaluezfu.exe
File created	C:\Windows\SysWOW64\cgcaluezfu.exe	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
File created	C:\Windows\SysWOW64\ebbozcullxfeugp.exe	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
File opened for modification	C:\Windows\SysWOW64\ebbozcullxfeugp.exe	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
File created	C:\Windows\SysWOW64\eptsttij.exe	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe

Drops file in Program Files directory 14 IoCs

Processes:

eptsttij.exeeptsttij.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eptsttij.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	eptsttij.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eptsttij.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	eptsttij.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eptsttij.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eptsttij.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	eptsttij.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	eptsttij.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eptsttij.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eptsttij.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eptsttij.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eptsttij.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	eptsttij.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	eptsttij.exe

Drops file in Windows directory 4 IoCs

Processes:

8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

explorer.exeWINWORD.EXEcgcaluezfu.exe8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	cgcaluezfu.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08068B0FF1F22DFD27DD0A88B089160"	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	cgcaluezfu.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	cgcaluezfu.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33402C7F9C5183276A3077D570232DAD7DF165DC"	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	cgcaluezfu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "194AC7751590DBC4B8BC7C95ED9337C8"	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1044 WINWORD.EXE

pid	process
1044	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.execgcaluezfu.exeeptsttij.exeoqkyysfglyffu.exeebbozcullxfeugp.exeeptsttij.exe

pid	process
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1080	cgcaluezfu.exe
1080	cgcaluezfu.exe
1080	cgcaluezfu.exe
1080	cgcaluezfu.exe
1080	cgcaluezfu.exe
680	eptsttij.exe
680	eptsttij.exe
680	eptsttij.exe
680	eptsttij.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
768	eptsttij.exe
768	eptsttij.exe
768	eptsttij.exe
768	eptsttij.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe
Token: 33	1924	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1924	AUDIODG.EXE
Token: 33	1924	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1924	AUDIODG.EXE
Token: SeShutdownPrivilege	1988	explorer.exe
Token: SeShutdownPrivilege	1988	explorer.exe

Suspicious use of FindShellTrayWindow 56 IoCs

Processes:

8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.execgcaluezfu.exeeptsttij.exeebbozcullxfeugp.exeoqkyysfglyffu.exeeptsttij.exeexplorer.exe

pid	process
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1080	cgcaluezfu.exe
1080	cgcaluezfu.exe
1080	cgcaluezfu.exe
680	eptsttij.exe
680	eptsttij.exe
680	eptsttij.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
768	eptsttij.exe
768	eptsttij.exe
768	eptsttij.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe

Suspicious use of SendNotifyMessage 38 IoCs

Processes:

8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.execgcaluezfu.exeeptsttij.exeebbozcullxfeugp.exeoqkyysfglyffu.exeexplorer.exe

pid	process
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
1080	cgcaluezfu.exe
1080	cgcaluezfu.exe
1080	cgcaluezfu.exe
680	eptsttij.exe
680	eptsttij.exe
680	eptsttij.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
544	ebbozcullxfeugp.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
1496	oqkyysfglyffu.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe
1988	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1044 WINWORD.EXE
1044 WINWORD.EXE

pid	process
1044	WINWORD.EXE
1044	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.execgcaluezfu.exeWINWORD.EXE

description	pid	process	target process
PID 1352 wrote to memory of 1080	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	cgcaluezfu.exe
PID 1352 wrote to memory of 1080	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	cgcaluezfu.exe
PID 1352 wrote to memory of 1080	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	cgcaluezfu.exe
PID 1352 wrote to memory of 1080	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	cgcaluezfu.exe
PID 1352 wrote to memory of 544	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	ebbozcullxfeugp.exe
PID 1352 wrote to memory of 544	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	ebbozcullxfeugp.exe
PID 1352 wrote to memory of 544	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	ebbozcullxfeugp.exe
PID 1352 wrote to memory of 544	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	ebbozcullxfeugp.exe
PID 1352 wrote to memory of 680	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	eptsttij.exe
PID 1352 wrote to memory of 680	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	eptsttij.exe
PID 1352 wrote to memory of 680	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	eptsttij.exe
PID 1352 wrote to memory of 680	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	eptsttij.exe
PID 1352 wrote to memory of 1496	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	oqkyysfglyffu.exe
PID 1352 wrote to memory of 1496	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	oqkyysfglyffu.exe
PID 1352 wrote to memory of 1496	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	oqkyysfglyffu.exe
PID 1352 wrote to memory of 1496	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	oqkyysfglyffu.exe
PID 1080 wrote to memory of 768	1080	cgcaluezfu.exe	eptsttij.exe
PID 1080 wrote to memory of 768	1080	cgcaluezfu.exe	eptsttij.exe
PID 1080 wrote to memory of 768	1080	cgcaluezfu.exe	eptsttij.exe
PID 1080 wrote to memory of 768	1080	cgcaluezfu.exe	eptsttij.exe
PID 1352 wrote to memory of 1044	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	WINWORD.EXE
PID 1352 wrote to memory of 1044	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	WINWORD.EXE
PID 1352 wrote to memory of 1044	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	WINWORD.EXE
PID 1352 wrote to memory of 1044	1352	8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe	WINWORD.EXE
PID 1044 wrote to memory of 928	1044	WINWORD.EXE	splwow64.exe
PID 1044 wrote to memory of 928	1044	WINWORD.EXE	splwow64.exe
PID 1044 wrote to memory of 928	1044	WINWORD.EXE	splwow64.exe
PID 1044 wrote to memory of 928	1044	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe
"C:\Users\Admin\AppData\Local\Temp\8df9a798e07b9bb156fc4d0d501ddb2922f3e0edd2704c9e108e132ded3f477a.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\cgcaluezfu.exe
cgcaluezfu.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\eptsttij.exe
C:\Windows\system32\eptsttij.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:768

C:\Windows\SysWOW64\ebbozcullxfeugp.exe
ebbozcullxfeugp.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:544

C:\Windows\SysWOW64\eptsttij.exe
eptsttij.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:680

C:\Windows\SysWOW64\oqkyysfglyffu.exe
oqkyysfglyffu.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1496

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:928

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1988

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x598
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
1bd517ff5c22cf543b8e6bffee52d1ac

SHA1
0d86266aeb751cb26cce04d927de9f7a2b9aba1f

SHA256
3eb629a123dc31f77495e81df3d39ed649c8e691337d5f4e5e46d4f0762c219b

SHA512
dee7787610c7e64b04b9ff6ee925e602b62ea0cd1d400ab5b5e8c8d7127fb854dfac73833ccc9df43c563ca18f2d9a7adce0cd3739c9096b10181084c30ae2ae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
a7d6bad64a09a95c6803853b2bfaee13

SHA1
5118603e34cb8295a52617eb47112819f065f975

SHA256
21182b27d2bda65931e68e03ba95ca758681744030ba2b23f7868f81c07a973c

SHA512
2b8e6a4c6f3016596aef8dc7d423161dbd7ef56ef0ec00b6a86153d68813423b7ce38e6afdaf0c2e8ccfa5439fcf14152aa5684106dfd2bf131521782c5ecff7

Download Submit
C:\Windows\SysWOW64\cgcaluezfu.exe

Filesize
255KB

MD5
bd8afed00307c348a05556e460b3de7b

SHA1
15313eb4fe8d46f2bde1775ecac21bec83987203

SHA256
a82ca07181905eecbc2b3642826f884f1ab3875d36084f40c3d1e7388a911c17

SHA512
3b0595d3b596e89e757bf125a9bd3d95ac30abbf87d53ed6fe3c9d107db72dd0ddacac71f7d76132cb83e6aec4502aceb3516c8181c9628a6ccc472cbc5d49a6

Download Submit
C:\Windows\SysWOW64\cgcaluezfu.exe

Filesize
255KB

MD5
bd8afed00307c348a05556e460b3de7b

SHA1
15313eb4fe8d46f2bde1775ecac21bec83987203

SHA256
a82ca07181905eecbc2b3642826f884f1ab3875d36084f40c3d1e7388a911c17

SHA512
3b0595d3b596e89e757bf125a9bd3d95ac30abbf87d53ed6fe3c9d107db72dd0ddacac71f7d76132cb83e6aec4502aceb3516c8181c9628a6ccc472cbc5d49a6

Download Submit
C:\Windows\SysWOW64\ebbozcullxfeugp.exe

Filesize
255KB

MD5
305f44cde9374783b469853d2b9ff9c1

SHA1
642c04f0c1ae1d39c7ba2a616624ea4b93d12501

SHA256
82cf8266f9160a06175e95bfbde737293f899fb072598e4689e35d1889f6890b

SHA512
567d97f2e98523fba1720d32e9b6907e8c6b1a953bb9de229ff346f2fadb784d6b6aa6121a602c5d78bb80920791298669d7455d51548722056e12c2b2e153bf

Download Submit
C:\Windows\SysWOW64\ebbozcullxfeugp.exe

Filesize
255KB

MD5
305f44cde9374783b469853d2b9ff9c1

SHA1
642c04f0c1ae1d39c7ba2a616624ea4b93d12501

SHA256
82cf8266f9160a06175e95bfbde737293f899fb072598e4689e35d1889f6890b

SHA512
567d97f2e98523fba1720d32e9b6907e8c6b1a953bb9de229ff346f2fadb784d6b6aa6121a602c5d78bb80920791298669d7455d51548722056e12c2b2e153bf

Download Submit
C:\Windows\SysWOW64\eptsttij.exe

Filesize
255KB

MD5
bd07b6f897b55aebce04d7117f20405b

SHA1
a9c5b3fa3b025ac7eb03ccb8b90d47a1f8239e05

SHA256
b3c9995407eaff50cbedde94c2081ef773d3fcef21c55a13a8eebbc3dcc94a2d

SHA512
806389cd229441d484b33da7c3c23f0f2c9f6dbaaec446dad09b06accce0c395af1fd994522df935322e158b3f93db8376d88227d6ff9792c82e2804935e334c

Download Submit
C:\Windows\SysWOW64\eptsttij.exe

Filesize
255KB

MD5
bd07b6f897b55aebce04d7117f20405b

SHA1
a9c5b3fa3b025ac7eb03ccb8b90d47a1f8239e05

SHA256
b3c9995407eaff50cbedde94c2081ef773d3fcef21c55a13a8eebbc3dcc94a2d

SHA512
806389cd229441d484b33da7c3c23f0f2c9f6dbaaec446dad09b06accce0c395af1fd994522df935322e158b3f93db8376d88227d6ff9792c82e2804935e334c

Download Submit
C:\Windows\SysWOW64\eptsttij.exe

Filesize
255KB

MD5
bd07b6f897b55aebce04d7117f20405b

SHA1
a9c5b3fa3b025ac7eb03ccb8b90d47a1f8239e05

SHA256
b3c9995407eaff50cbedde94c2081ef773d3fcef21c55a13a8eebbc3dcc94a2d

SHA512
806389cd229441d484b33da7c3c23f0f2c9f6dbaaec446dad09b06accce0c395af1fd994522df935322e158b3f93db8376d88227d6ff9792c82e2804935e334c

Download Submit
C:\Windows\SysWOW64\oqkyysfglyffu.exe

Filesize
255KB

MD5
b99ba26471365ec6dcae8a14cf056277

SHA1
c44193c13811f08052ffc7318aa8db6b8e7ab87e

SHA256
0251efcca1280b2ef072cb5de13e8156d89eb010c60b807fe0777c8d32556a91

SHA512
189861614fbd12a622dc51a59ccd6cd27c099951cda0b5d16418ab380c4d1aa54ba8b1af13a730ee291461233384abefefad8af7fb596bbeb4d152a7d90d2fd4

Download Submit
C:\Windows\SysWOW64\oqkyysfglyffu.exe

Filesize
255KB

MD5
b99ba26471365ec6dcae8a14cf056277

SHA1
c44193c13811f08052ffc7318aa8db6b8e7ab87e

SHA256
0251efcca1280b2ef072cb5de13e8156d89eb010c60b807fe0777c8d32556a91

SHA512
189861614fbd12a622dc51a59ccd6cd27c099951cda0b5d16418ab380c4d1aa54ba8b1af13a730ee291461233384abefefad8af7fb596bbeb4d152a7d90d2fd4

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
a7d6bad64a09a95c6803853b2bfaee13

SHA1
5118603e34cb8295a52617eb47112819f065f975

SHA256
21182b27d2bda65931e68e03ba95ca758681744030ba2b23f7868f81c07a973c

SHA512
2b8e6a4c6f3016596aef8dc7d423161dbd7ef56ef0ec00b6a86153d68813423b7ce38e6afdaf0c2e8ccfa5439fcf14152aa5684106dfd2bf131521782c5ecff7

Download Submit
\Windows\SysWOW64\cgcaluezfu.exe

Filesize
255KB

MD5
bd8afed00307c348a05556e460b3de7b

SHA1
15313eb4fe8d46f2bde1775ecac21bec83987203

SHA256
a82ca07181905eecbc2b3642826f884f1ab3875d36084f40c3d1e7388a911c17

SHA512
3b0595d3b596e89e757bf125a9bd3d95ac30abbf87d53ed6fe3c9d107db72dd0ddacac71f7d76132cb83e6aec4502aceb3516c8181c9628a6ccc472cbc5d49a6

Download Submit
\Windows\SysWOW64\ebbozcullxfeugp.exe

Filesize
255KB

MD5
305f44cde9374783b469853d2b9ff9c1

SHA1
642c04f0c1ae1d39c7ba2a616624ea4b93d12501

SHA256
82cf8266f9160a06175e95bfbde737293f899fb072598e4689e35d1889f6890b

SHA512
567d97f2e98523fba1720d32e9b6907e8c6b1a953bb9de229ff346f2fadb784d6b6aa6121a602c5d78bb80920791298669d7455d51548722056e12c2b2e153bf

Download Submit
\Windows\SysWOW64\eptsttij.exe

Filesize
255KB

MD5
bd07b6f897b55aebce04d7117f20405b

SHA1
a9c5b3fa3b025ac7eb03ccb8b90d47a1f8239e05

SHA256
b3c9995407eaff50cbedde94c2081ef773d3fcef21c55a13a8eebbc3dcc94a2d

SHA512
806389cd229441d484b33da7c3c23f0f2c9f6dbaaec446dad09b06accce0c395af1fd994522df935322e158b3f93db8376d88227d6ff9792c82e2804935e334c

Download Submit
\Windows\SysWOW64\eptsttij.exe

Filesize
255KB

MD5
bd07b6f897b55aebce04d7117f20405b

SHA1
a9c5b3fa3b025ac7eb03ccb8b90d47a1f8239e05

SHA256
b3c9995407eaff50cbedde94c2081ef773d3fcef21c55a13a8eebbc3dcc94a2d

SHA512
806389cd229441d484b33da7c3c23f0f2c9f6dbaaec446dad09b06accce0c395af1fd994522df935322e158b3f93db8376d88227d6ff9792c82e2804935e334c

Download Submit
\Windows\SysWOW64\oqkyysfglyffu.exe

Filesize
255KB

MD5
b99ba26471365ec6dcae8a14cf056277

SHA1
c44193c13811f08052ffc7318aa8db6b8e7ab87e

SHA256
0251efcca1280b2ef072cb5de13e8156d89eb010c60b807fe0777c8d32556a91

SHA512
189861614fbd12a622dc51a59ccd6cd27c099951cda0b5d16418ab380c4d1aa54ba8b1af13a730ee291461233384abefefad8af7fb596bbeb4d152a7d90d2fd4

Download Submit
memory/544-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/544-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/544-61-0x0000000000000000-mapping.dmp

Download
memory/680-66-0x0000000000000000-mapping.dmp

Download
memory/680-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/680-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/768-77-0x0000000000000000-mapping.dmp

Download
memory/768-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/768-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/928-104-0x0000000000000000-mapping.dmp

Download
memory/1044-80-0x0000000000000000-mapping.dmp

Download
memory/1044-88-0x00000000724B1000-0x00000000724B4000-memory.dmp

Filesize
12KB

Download
memory/1044-89-0x000000006FF31000-0x000000006FF33000-memory.dmp

Filesize
8KB

Download
memory/1044-90-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1044-93-0x0000000070F1D000-0x0000000070F28000-memory.dmp

Filesize
44KB

Download
memory/1044-100-0x0000000070F1D000-0x0000000070F28000-memory.dmp

Filesize
44KB

Download
memory/1080-57-0x0000000000000000-mapping.dmp

Download
memory/1080-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1080-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1352-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1352-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1352-81-0x0000000002F70000-0x0000000003010000-memory.dmp

Filesize
640KB

Download
memory/1352-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1496-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1496-70-0x0000000000000000-mapping.dmp

Download
memory/1496-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1988-94-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download