54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581

Analysis

max time kernel
151s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
Size

512KB
MD5

81417560f7655a7b6e5b5fa6f8d9ef20
SHA1

baff639a3cb84257c15bc3a1b75926e4e42b8bf7
SHA256

54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581
SHA512

ee8d77c362df3e33287ee2743c8c1c6e22522905e0aa6aded7d32cfef21ea2ba8fbb7496f67b0c252dabff7fe31a4ab78a270b4cc8b9da3d6a6b18feba677213
SSDEEP

6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

pwhaqyvqfg.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	pwhaqyvqfg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

pwhaqyvqfg.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	pwhaqyvqfg.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

pwhaqyvqfg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	pwhaqyvqfg.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

pwhaqyvqfg.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwhaqyvqfg.exe

Executes dropped EXE 5 IoCs

Processes:

pwhaqyvqfg.exewzqfoogexlodcxp.exeyktbquxc.exeeopnghocbfiqy.exeyktbquxc.exe

pid process

1516 pwhaqyvqfg.exe
468 wzqfoogexlodcxp.exe
1104 yktbquxc.exe
1052 eopnghocbfiqy.exe
1640 yktbquxc.exe

pid	process
1516	pwhaqyvqfg.exe
468	wzqfoogexlodcxp.exe
1104	yktbquxc.exe
1052	eopnghocbfiqy.exe
1640	yktbquxc.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Loads dropped DLL 5 IoCs

Processes:

54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exepwhaqyvqfg.exe

pid	process
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1516	pwhaqyvqfg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

pwhaqyvqfg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	pwhaqyvqfg.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wzqfoogexlodcxp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\usdgwwze = "wzqfoogexlodcxp.exe"	wzqfoogexlodcxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "eopnghocbfiqy.exe"	wzqfoogexlodcxp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	wzqfoogexlodcxp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fitvfjqb = "pwhaqyvqfg.exe"	wzqfoogexlodcxp.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

yktbquxc.exepwhaqyvqfg.exeyktbquxc.exe

description	ioc	process
File opened (read-only)	\??\f:	yktbquxc.exe
File opened (read-only)	\??\g:	pwhaqyvqfg.exe
File opened (read-only)	\??\j:	pwhaqyvqfg.exe
File opened (read-only)	\??\g:	yktbquxc.exe
File opened (read-only)	\??\i:	yktbquxc.exe
File opened (read-only)	\??\k:	yktbquxc.exe
File opened (read-only)	\??\g:	yktbquxc.exe
File opened (read-only)	\??\i:	yktbquxc.exe
File opened (read-only)	\??\b:	yktbquxc.exe
File opened (read-only)	\??\o:	yktbquxc.exe
File opened (read-only)	\??\q:	yktbquxc.exe
File opened (read-only)	\??\k:	pwhaqyvqfg.exe
File opened (read-only)	\??\n:	pwhaqyvqfg.exe
File opened (read-only)	\??\t:	pwhaqyvqfg.exe
File opened (read-only)	\??\q:	yktbquxc.exe
File opened (read-only)	\??\x:	yktbquxc.exe
File opened (read-only)	\??\r:	yktbquxc.exe
File opened (read-only)	\??\s:	yktbquxc.exe
File opened (read-only)	\??\b:	pwhaqyvqfg.exe
File opened (read-only)	\??\v:	pwhaqyvqfg.exe
File opened (read-only)	\??\j:	yktbquxc.exe
File opened (read-only)	\??\m:	yktbquxc.exe
File opened (read-only)	\??\n:	yktbquxc.exe
File opened (read-only)	\??\y:	yktbquxc.exe
File opened (read-only)	\??\q:	pwhaqyvqfg.exe
File opened (read-only)	\??\z:	pwhaqyvqfg.exe
File opened (read-only)	\??\a:	yktbquxc.exe
File opened (read-only)	\??\t:	yktbquxc.exe
File opened (read-only)	\??\a:	pwhaqyvqfg.exe
File opened (read-only)	\??\r:	pwhaqyvqfg.exe
File opened (read-only)	\??\o:	yktbquxc.exe
File opened (read-only)	\??\r:	yktbquxc.exe
File opened (read-only)	\??\e:	pwhaqyvqfg.exe
File opened (read-only)	\??\l:	pwhaqyvqfg.exe
File opened (read-only)	\??\x:	yktbquxc.exe
File opened (read-only)	\??\b:	yktbquxc.exe
File opened (read-only)	\??\e:	yktbquxc.exe
File opened (read-only)	\??\w:	yktbquxc.exe
File opened (read-only)	\??\f:	pwhaqyvqfg.exe
File opened (read-only)	\??\o:	pwhaqyvqfg.exe
File opened (read-only)	\??\y:	yktbquxc.exe
File opened (read-only)	\??\t:	yktbquxc.exe
File opened (read-only)	\??\k:	yktbquxc.exe
File opened (read-only)	\??\m:	pwhaqyvqfg.exe
File opened (read-only)	\??\s:	pwhaqyvqfg.exe
File opened (read-only)	\??\e:	yktbquxc.exe
File opened (read-only)	\??\h:	yktbquxc.exe
File opened (read-only)	\??\m:	yktbquxc.exe
File opened (read-only)	\??\h:	pwhaqyvqfg.exe
File opened (read-only)	\??\w:	yktbquxc.exe
File opened (read-only)	\??\z:	yktbquxc.exe
File opened (read-only)	\??\i:	pwhaqyvqfg.exe
File opened (read-only)	\??\u:	pwhaqyvqfg.exe
File opened (read-only)	\??\x:	pwhaqyvqfg.exe
File opened (read-only)	\??\f:	yktbquxc.exe
File opened (read-only)	\??\s:	yktbquxc.exe
File opened (read-only)	\??\a:	yktbquxc.exe
File opened (read-only)	\??\j:	yktbquxc.exe
File opened (read-only)	\??\v:	yktbquxc.exe
File opened (read-only)	\??\z:	yktbquxc.exe
File opened (read-only)	\??\p:	pwhaqyvqfg.exe
File opened (read-only)	\??\w:	pwhaqyvqfg.exe
File opened (read-only)	\??\v:	yktbquxc.exe
File opened (read-only)	\??\l:	yktbquxc.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

pwhaqyvqfg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	pwhaqyvqfg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	pwhaqyvqfg.exe

AutoIT Executable 20 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1288-55-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
\Windows\SysWOW64\pwhaqyvqfg.exe	autoit_exe
C:\Windows\SysWOW64\pwhaqyvqfg.exe	autoit_exe
C:\Windows\SysWOW64\pwhaqyvqfg.exe	autoit_exe
\Windows\SysWOW64\wzqfoogexlodcxp.exe	autoit_exe
C:\Windows\SysWOW64\wzqfoogexlodcxp.exe	autoit_exe
C:\Windows\SysWOW64\yktbquxc.exe	autoit_exe
C:\Windows\SysWOW64\wzqfoogexlodcxp.exe	autoit_exe
C:\Windows\SysWOW64\eopnghocbfiqy.exe	autoit_exe
\Windows\SysWOW64\eopnghocbfiqy.exe	autoit_exe
\Windows\SysWOW64\yktbquxc.exe	autoit_exe
C:\Windows\SysWOW64\yktbquxc.exe	autoit_exe
C:\Windows\SysWOW64\eopnghocbfiqy.exe	autoit_exe
\Windows\SysWOW64\yktbquxc.exe	autoit_exe
C:\Windows\SysWOW64\yktbquxc.exe	autoit_exe
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	autoit_exe
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	autoit_exe
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	autoit_exe
C:\Users\Admin\Documents\FormatImport.doc.exe	autoit_exe
C:\Users\Admin\Documents\FormatImport.doc.exe	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exepwhaqyvqfg.exe

description	ioc	process
File created	C:\Windows\SysWOW64\pwhaqyvqfg.exe	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
File created	C:\Windows\SysWOW64\wzqfoogexlodcxp.exe	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
File created	C:\Windows\SysWOW64\yktbquxc.exe	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
File opened for modification	C:\Windows\SysWOW64\yktbquxc.exe	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
File created	C:\Windows\SysWOW64\eopnghocbfiqy.exe	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	pwhaqyvqfg.exe
File opened for modification	C:\Windows\SysWOW64\pwhaqyvqfg.exe	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
File opened for modification	C:\Windows\SysWOW64\wzqfoogexlodcxp.exe	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
File opened for modification	C:\Windows\SysWOW64\eopnghocbfiqy.exe	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe

Drops file in Program Files directory 15 IoCs

Processes:

yktbquxc.exeyktbquxc.exe

description	ioc	process
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	yktbquxc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	yktbquxc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	yktbquxc.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	yktbquxc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	yktbquxc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	yktbquxc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	yktbquxc.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	yktbquxc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	yktbquxc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	yktbquxc.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	yktbquxc.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	yktbquxc.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	yktbquxc.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	yktbquxc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	yktbquxc.exe

Drops file in Windows directory 4 IoCs

Processes:

54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEpwhaqyvqfg.exe54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exeexplorer.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	pwhaqyvqfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	pwhaqyvqfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	pwhaqyvqfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF4FF884F5B851F9146D72F7DE1BDEEE1305941674E623FD69D"	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	pwhaqyvqfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1536 WINWORD.EXE

pid	process
1536	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exepwhaqyvqfg.exeyktbquxc.exewzqfoogexlodcxp.exeeopnghocbfiqy.exeyktbquxc.exe

pid	process
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1516	pwhaqyvqfg.exe
1516	pwhaqyvqfg.exe
1516	pwhaqyvqfg.exe
1516	pwhaqyvqfg.exe
1516	pwhaqyvqfg.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1104	yktbquxc.exe
1104	yktbquxc.exe
1104	yktbquxc.exe
1104	yktbquxc.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
1640	yktbquxc.exe
1640	yktbquxc.exe
1640	yktbquxc.exe
1640	yktbquxc.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
468	wzqfoogexlodcxp.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1952 explorer.exe

pid	process
1952	explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe
Token: 33	880	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	880	AUDIODG.EXE
Token: 33	880	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	880	AUDIODG.EXE
Token: SeShutdownPrivilege	1952	explorer.exe
Token: SeShutdownPrivilege	1952	explorer.exe

Suspicious use of FindShellTrayWindow 44 IoCs

Processes:

54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exepwhaqyvqfg.exewzqfoogexlodcxp.exeyktbquxc.exeeopnghocbfiqy.exeyktbquxc.exeexplorer.exe

pid	process
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1516	pwhaqyvqfg.exe
1516	pwhaqyvqfg.exe
1516	pwhaqyvqfg.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
1104	yktbquxc.exe
1104	yktbquxc.exe
1104	yktbquxc.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
1640	yktbquxc.exe
1640	yktbquxc.exe
1640	yktbquxc.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe

Suspicious use of SendNotifyMessage 33 IoCs

Processes:

54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exepwhaqyvqfg.exewzqfoogexlodcxp.exeyktbquxc.exeeopnghocbfiqy.exeexplorer.exe

pid	process
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
1516	pwhaqyvqfg.exe
1516	pwhaqyvqfg.exe
1516	pwhaqyvqfg.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
468	wzqfoogexlodcxp.exe
1104	yktbquxc.exe
1104	yktbquxc.exe
1104	yktbquxc.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
1052	eopnghocbfiqy.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe
1952	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1536 WINWORD.EXE
1536 WINWORD.EXE

pid	process
1536	WINWORD.EXE
1536	WINWORD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exepwhaqyvqfg.exe

description	pid	process	target process
PID 1288 wrote to memory of 1516	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	pwhaqyvqfg.exe
PID 1288 wrote to memory of 1516	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	pwhaqyvqfg.exe
PID 1288 wrote to memory of 1516	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	pwhaqyvqfg.exe
PID 1288 wrote to memory of 1516	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	pwhaqyvqfg.exe
PID 1288 wrote to memory of 468	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	wzqfoogexlodcxp.exe
PID 1288 wrote to memory of 468	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	wzqfoogexlodcxp.exe
PID 1288 wrote to memory of 468	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	wzqfoogexlodcxp.exe
PID 1288 wrote to memory of 468	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	wzqfoogexlodcxp.exe
PID 1288 wrote to memory of 1104	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	yktbquxc.exe
PID 1288 wrote to memory of 1104	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	yktbquxc.exe
PID 1288 wrote to memory of 1104	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	yktbquxc.exe
PID 1288 wrote to memory of 1104	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	yktbquxc.exe
PID 1288 wrote to memory of 1052	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	eopnghocbfiqy.exe
PID 1288 wrote to memory of 1052	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	eopnghocbfiqy.exe
PID 1288 wrote to memory of 1052	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	eopnghocbfiqy.exe
PID 1288 wrote to memory of 1052	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	eopnghocbfiqy.exe
PID 1516 wrote to memory of 1640	1516	pwhaqyvqfg.exe	yktbquxc.exe
PID 1516 wrote to memory of 1640	1516	pwhaqyvqfg.exe	yktbquxc.exe
PID 1516 wrote to memory of 1640	1516	pwhaqyvqfg.exe	yktbquxc.exe
PID 1516 wrote to memory of 1640	1516	pwhaqyvqfg.exe	yktbquxc.exe
PID 1288 wrote to memory of 1536	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	WINWORD.EXE
PID 1288 wrote to memory of 1536	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	WINWORD.EXE
PID 1288 wrote to memory of 1536	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	WINWORD.EXE
PID 1288 wrote to memory of 1536	1288	54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe
"C:\Users\Admin\AppData\Local\Temp\54e7789df27b64bcf0a747c1374c8b91bb8a7e039517c34140a65f6d9fdf2581.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\pwhaqyvqfg.exe
pwhaqyvqfg.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1516

C:\Windows\SysWOW64\yktbquxc.exe
C:\Windows\system32\yktbquxc.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1640

C:\Windows\SysWOW64\wzqfoogexlodcxp.exe
wzqfoogexlodcxp.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:468

C:\Windows\SysWOW64\eopnghocbfiqy.exe
eopnghocbfiqy.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1052

C:\Windows\SysWOW64\yktbquxc.exe
yktbquxc.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1104

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1536

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x598
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
512KB

MD5
7d93193724fdbe11322887e0ecca6cab

SHA1
fb0d38a9793c4641923b78a28888a97ad2f63003

SHA256
3fc666cabadf9372f764e804dfde0e0005bea6265cc72bd9894ec623dca2cc13

SHA512
f9beaf98f282194442a85d19d088cdfaf1065f38012d234f3caff83896db91b0f466596699f342eda65458fe8ee71ac16c41dba80e190ecf5c343c339112927c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
512KB

MD5
c7e897af0fbc644ae56c4873434a3407

SHA1
78bcfca3ab7fb5339935bc28c72e4bb099bd5426

SHA256
e447823fe58be5162662b6c9009464cb96a271111856f2b4a60b12585693526f

SHA512
d50fba6e25ebae47b6e0098ed67befe799fd66a8241afb37109c936fa4c5b5d422c688862baf14165f28d4108e1baaf89f05d6e106ecf0e565f4ee0defdabc1e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
512KB

MD5
c7e897af0fbc644ae56c4873434a3407

SHA1
78bcfca3ab7fb5339935bc28c72e4bb099bd5426

SHA256
e447823fe58be5162662b6c9009464cb96a271111856f2b4a60b12585693526f

SHA512
d50fba6e25ebae47b6e0098ed67befe799fd66a8241afb37109c936fa4c5b5d422c688862baf14165f28d4108e1baaf89f05d6e106ecf0e565f4ee0defdabc1e

Download Submit
C:\Users\Admin\Documents\FormatImport.doc.exe

Filesize
512KB

MD5
6a25d064c5c09f7d14e1201396d28e2e

SHA1
e68974653a6581548fc095c21e6c002e1604b311

SHA256
e1605b2b6edb236d0cc155d70a7182a196f5e3331a3c5f1fdbe84a841bd63aad

SHA512
cd2ad500b33933b50ef075b2b29ca11cae2e0b9b9eddaac6961f271677ca9a8a31fc211fc9b2329212c7937bcf8882c435ba7212eb888719692c00f6da27a5f1

Download Submit
C:\Users\Admin\Documents\FormatImport.doc.exe

Filesize
512KB

MD5
6a25d064c5c09f7d14e1201396d28e2e

SHA1
e68974653a6581548fc095c21e6c002e1604b311

SHA256
e1605b2b6edb236d0cc155d70a7182a196f5e3331a3c5f1fdbe84a841bd63aad

SHA512
cd2ad500b33933b50ef075b2b29ca11cae2e0b9b9eddaac6961f271677ca9a8a31fc211fc9b2329212c7937bcf8882c435ba7212eb888719692c00f6da27a5f1

Download Submit
C:\Windows\SysWOW64\eopnghocbfiqy.exe

Filesize
512KB

MD5
1163762c1435cbefbfd453e5bcacc4e6

SHA1
69da346b0239ecb28aa3b4bbf3d75ea7ffa061a0

SHA256
166c5b66aa63bad40f7281f859ad2c4c2913954478fd0a15e650270af1f0ebd1

SHA512
ffee439e54cd0a0e8430301566668d5214646e1e3c973836435a9c3b6fe48f3f99131bd4c66f53d807bbdea58e9f6b7a2d28ee8d5251cef344df9b854cf7fec3

Download Submit
C:\Windows\SysWOW64\eopnghocbfiqy.exe

Filesize
512KB

MD5
1163762c1435cbefbfd453e5bcacc4e6

SHA1
69da346b0239ecb28aa3b4bbf3d75ea7ffa061a0

SHA256
166c5b66aa63bad40f7281f859ad2c4c2913954478fd0a15e650270af1f0ebd1

SHA512
ffee439e54cd0a0e8430301566668d5214646e1e3c973836435a9c3b6fe48f3f99131bd4c66f53d807bbdea58e9f6b7a2d28ee8d5251cef344df9b854cf7fec3

Download Submit
C:\Windows\SysWOW64\pwhaqyvqfg.exe

Filesize
512KB

MD5
8b7449f073ee57489ed2ca8c522b1dac

SHA1
76ad25251cfb9fd7a57ad59efb74d199f8c5532b

SHA256
b931f52ff68149a5f5af3e6340ce3bcbf3e3290ae0fce06e4dd2d46de5162d78

SHA512
3b02e52d947698b23b74b7e1131a17e10b098f611c9d5f9bb89533fdb9bc39cc5d24aca1de1c6cf01c2ec61aa08e7c41c28b8590a6b9ff8eb6d0f8e62cde2bc5

Download Submit
C:\Windows\SysWOW64\pwhaqyvqfg.exe

Filesize
512KB

MD5
8b7449f073ee57489ed2ca8c522b1dac

SHA1
76ad25251cfb9fd7a57ad59efb74d199f8c5532b

SHA256
b931f52ff68149a5f5af3e6340ce3bcbf3e3290ae0fce06e4dd2d46de5162d78

SHA512
3b02e52d947698b23b74b7e1131a17e10b098f611c9d5f9bb89533fdb9bc39cc5d24aca1de1c6cf01c2ec61aa08e7c41c28b8590a6b9ff8eb6d0f8e62cde2bc5

Download Submit
C:\Windows\SysWOW64\wzqfoogexlodcxp.exe

Filesize
512KB

MD5
bde3232876cd890abcbcf76c001f7a27

SHA1
8d889194ca1823a84c1fc045e778ab9fd2bfdea9

SHA256
28d7eaa1d731f7f1b0e709c5716f023650f76553a986a9ebdcb6a3df6b651ef4

SHA512
ee7675b993306d7dc4a61c8e703d0674e3eb112430c151d6b852d038222e49a94a8b39e8711ce719a4f3739eff7765167e88b22cf06d00a4c010f4e7b794d96e

Download Submit
C:\Windows\SysWOW64\wzqfoogexlodcxp.exe

Filesize
512KB

MD5
bde3232876cd890abcbcf76c001f7a27

SHA1
8d889194ca1823a84c1fc045e778ab9fd2bfdea9

SHA256
28d7eaa1d731f7f1b0e709c5716f023650f76553a986a9ebdcb6a3df6b651ef4

SHA512
ee7675b993306d7dc4a61c8e703d0674e3eb112430c151d6b852d038222e49a94a8b39e8711ce719a4f3739eff7765167e88b22cf06d00a4c010f4e7b794d96e

Download Submit
C:\Windows\SysWOW64\yktbquxc.exe

Filesize
512KB

MD5
511ba5bc4e7a70cbc718ac7c76b0d17b

SHA1
502d845a8d4cd82790f045d2c734a7969c4e1368

SHA256
5a8666fd1b90e52c46f796fdee15876f77b1ec0cf705d51a7db481a18776833e

SHA512
df17d06fdeb38f5a5b6379eb0f5fad2b65c9a3eec720948840ae751d40953118b8a970a3ffc15e8116791d1468e927302f89381a757747ea0192532dc684ecc7

Download Submit
C:\Windows\SysWOW64\yktbquxc.exe

Filesize
512KB

MD5
511ba5bc4e7a70cbc718ac7c76b0d17b

SHA1
502d845a8d4cd82790f045d2c734a7969c4e1368

SHA256
5a8666fd1b90e52c46f796fdee15876f77b1ec0cf705d51a7db481a18776833e

SHA512
df17d06fdeb38f5a5b6379eb0f5fad2b65c9a3eec720948840ae751d40953118b8a970a3ffc15e8116791d1468e927302f89381a757747ea0192532dc684ecc7

Download Submit
C:\Windows\SysWOW64\yktbquxc.exe

Filesize
512KB

MD5
511ba5bc4e7a70cbc718ac7c76b0d17b

SHA1
502d845a8d4cd82790f045d2c734a7969c4e1368

SHA256
5a8666fd1b90e52c46f796fdee15876f77b1ec0cf705d51a7db481a18776833e

SHA512
df17d06fdeb38f5a5b6379eb0f5fad2b65c9a3eec720948840ae751d40953118b8a970a3ffc15e8116791d1468e927302f89381a757747ea0192532dc684ecc7

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\eopnghocbfiqy.exe

Filesize
512KB

MD5
1163762c1435cbefbfd453e5bcacc4e6

SHA1
69da346b0239ecb28aa3b4bbf3d75ea7ffa061a0

SHA256
166c5b66aa63bad40f7281f859ad2c4c2913954478fd0a15e650270af1f0ebd1

SHA512
ffee439e54cd0a0e8430301566668d5214646e1e3c973836435a9c3b6fe48f3f99131bd4c66f53d807bbdea58e9f6b7a2d28ee8d5251cef344df9b854cf7fec3

Download Submit
\Windows\SysWOW64\pwhaqyvqfg.exe

Filesize
512KB

MD5
8b7449f073ee57489ed2ca8c522b1dac

SHA1
76ad25251cfb9fd7a57ad59efb74d199f8c5532b

SHA256
b931f52ff68149a5f5af3e6340ce3bcbf3e3290ae0fce06e4dd2d46de5162d78

SHA512
3b02e52d947698b23b74b7e1131a17e10b098f611c9d5f9bb89533fdb9bc39cc5d24aca1de1c6cf01c2ec61aa08e7c41c28b8590a6b9ff8eb6d0f8e62cde2bc5

Download Submit
\Windows\SysWOW64\wzqfoogexlodcxp.exe

Filesize
512KB

MD5
bde3232876cd890abcbcf76c001f7a27

SHA1
8d889194ca1823a84c1fc045e778ab9fd2bfdea9

SHA256
28d7eaa1d731f7f1b0e709c5716f023650f76553a986a9ebdcb6a3df6b651ef4

SHA512
ee7675b993306d7dc4a61c8e703d0674e3eb112430c151d6b852d038222e49a94a8b39e8711ce719a4f3739eff7765167e88b22cf06d00a4c010f4e7b794d96e

Download Submit
\Windows\SysWOW64\yktbquxc.exe

Filesize
512KB

MD5
511ba5bc4e7a70cbc718ac7c76b0d17b

SHA1
502d845a8d4cd82790f045d2c734a7969c4e1368

SHA256
5a8666fd1b90e52c46f796fdee15876f77b1ec0cf705d51a7db481a18776833e

SHA512
df17d06fdeb38f5a5b6379eb0f5fad2b65c9a3eec720948840ae751d40953118b8a970a3ffc15e8116791d1468e927302f89381a757747ea0192532dc684ecc7

Download Submit
\Windows\SysWOW64\yktbquxc.exe

Filesize
512KB

MD5
511ba5bc4e7a70cbc718ac7c76b0d17b

SHA1
502d845a8d4cd82790f045d2c734a7969c4e1368

SHA256
5a8666fd1b90e52c46f796fdee15876f77b1ec0cf705d51a7db481a18776833e

SHA512
df17d06fdeb38f5a5b6379eb0f5fad2b65c9a3eec720948840ae751d40953118b8a970a3ffc15e8116791d1468e927302f89381a757747ea0192532dc684ecc7

Download Submit
memory/468-63-0x0000000000000000-mapping.dmp

Download
memory/1052-73-0x0000000000000000-mapping.dmp

Download
memory/1104-68-0x0000000000000000-mapping.dmp

Download
memory/1288-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1288-55-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1516-57-0x0000000000000000-mapping.dmp

Download
memory/1536-91-0x000000007118D000-0x0000000071198000-memory.dmp

Filesize
44KB

Download
memory/1536-88-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1536-87-0x00000000701A1000-0x00000000701A3000-memory.dmp

Filesize
8KB

Download
memory/1536-86-0x0000000072721000-0x0000000072724000-memory.dmp

Filesize
12KB

Download
memory/1536-85-0x0000000000000000-mapping.dmp

Download
memory/1536-98-0x000000007118D000-0x0000000071198000-memory.dmp

Filesize
44KB

Download
memory/1640-81-0x0000000000000000-mapping.dmp

Download
memory/1952-92-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/1952-99-0x0000000002720000-0x0000000002730000-memory.dmp

Filesize
64KB

Download