d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
Size

255KB
MD5

91508f21b1ba973fe183e1244754aeb5
SHA1

6941b0b0681a97d59b4cd93d62a8ebe0da8ada8d
SHA256

d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1
SHA512

26982abf999b485387c76ff5b36cf54ad6b1045bd9b4f79e8970976bef613fe1e00fbe8f9d305953d6ef4341f74a6306980efe76a4955b6abe9add09f7857030
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJp:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI+

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

bnixstmswr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	bnixstmswr.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

bnixstmswr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bnixstmswr.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bnixstmswr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bnixstmswr.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

bnixstmswr.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bnixstmswr.exe

Executes dropped EXE 5 IoCs

Processes:

bnixstmswr.exekwyljbkceyeovsy.exeajcvgeky.exejjsotrcxbdbts.exeajcvgeky.exe

pid process

936 bnixstmswr.exe
1176 kwyljbkceyeovsy.exe
1376 ajcvgeky.exe
520 jjsotrcxbdbts.exe
1488 ajcvgeky.exe

pid	process
936	bnixstmswr.exe
1176	kwyljbkceyeovsy.exe
1376	ajcvgeky.exe
520	jjsotrcxbdbts.exe
1488	ajcvgeky.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\SysWOW64\bnixstmswr.exe	upx
C:\Windows\SysWOW64\bnixstmswr.exe	upx
\Windows\SysWOW64\kwyljbkceyeovsy.exe	upx
C:\Windows\SysWOW64\bnixstmswr.exe	upx
C:\Windows\SysWOW64\kwyljbkceyeovsy.exe	upx
\Windows\SysWOW64\ajcvgeky.exe	upx
C:\Windows\SysWOW64\ajcvgeky.exe	upx
C:\Windows\SysWOW64\kwyljbkceyeovsy.exe	upx
C:\Windows\SysWOW64\ajcvgeky.exe	upx
\Windows\SysWOW64\jjsotrcxbdbts.exe	upx
C:\Windows\SysWOW64\jjsotrcxbdbts.exe	upx
C:\Windows\SysWOW64\jjsotrcxbdbts.exe	upx
C:\Windows\SysWOW64\ajcvgeky.exe	upx
\Windows\SysWOW64\ajcvgeky.exe	upx
behavioral1/memory/1104-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/936-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1176-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1376-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/520-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1488-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files\EnterTrace.doc.exe	upx
behavioral1/memory/1104-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/936-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1176-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1376-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/520-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1488-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1488-102-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1376-103-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 5 IoCs

Processes:

d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exebnixstmswr.exe

pid	process
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
936	bnixstmswr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

bnixstmswr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bnixstmswr.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kwyljbkceyeovsy.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\hkurzhyx = "bnixstmswr.exe"	kwyljbkceyeovsy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\afcmvdyv = "kwyljbkceyeovsy.exe"	kwyljbkceyeovsy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jjsotrcxbdbts.exe"	kwyljbkceyeovsy.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	kwyljbkceyeovsy.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ajcvgeky.exeajcvgeky.exebnixstmswr.exe

description	ioc	process
File opened (read-only)	\??\e:	ajcvgeky.exe
File opened (read-only)	\??\b:	ajcvgeky.exe
File opened (read-only)	\??\v:	ajcvgeky.exe
File opened (read-only)	\??\l:	bnixstmswr.exe
File opened (read-only)	\??\n:	ajcvgeky.exe
File opened (read-only)	\??\y:	ajcvgeky.exe
File opened (read-only)	\??\h:	ajcvgeky.exe
File opened (read-only)	\??\n:	ajcvgeky.exe
File opened (read-only)	\??\s:	ajcvgeky.exe
File opened (read-only)	\??\y:	bnixstmswr.exe
File opened (read-only)	\??\a:	ajcvgeky.exe
File opened (read-only)	\??\e:	ajcvgeky.exe
File opened (read-only)	\??\y:	ajcvgeky.exe
File opened (read-only)	\??\g:	bnixstmswr.exe
File opened (read-only)	\??\q:	bnixstmswr.exe
File opened (read-only)	\??\f:	ajcvgeky.exe
File opened (read-only)	\??\r:	ajcvgeky.exe
File opened (read-only)	\??\j:	bnixstmswr.exe
File opened (read-only)	\??\f:	ajcvgeky.exe
File opened (read-only)	\??\t:	ajcvgeky.exe
File opened (read-only)	\??\k:	bnixstmswr.exe
File opened (read-only)	\??\r:	bnixstmswr.exe
File opened (read-only)	\??\j:	ajcvgeky.exe
File opened (read-only)	\??\b:	bnixstmswr.exe
File opened (read-only)	\??\e:	bnixstmswr.exe
File opened (read-only)	\??\n:	bnixstmswr.exe
File opened (read-only)	\??\h:	ajcvgeky.exe
File opened (read-only)	\??\r:	ajcvgeky.exe
File opened (read-only)	\??\q:	ajcvgeky.exe
File opened (read-only)	\??\u:	bnixstmswr.exe
File opened (read-only)	\??\o:	ajcvgeky.exe
File opened (read-only)	\??\q:	ajcvgeky.exe
File opened (read-only)	\??\g:	ajcvgeky.exe
File opened (read-only)	\??\l:	ajcvgeky.exe
File opened (read-only)	\??\m:	ajcvgeky.exe
File opened (read-only)	\??\m:	bnixstmswr.exe
File opened (read-only)	\??\t:	bnixstmswr.exe
File opened (read-only)	\??\x:	bnixstmswr.exe
File opened (read-only)	\??\z:	bnixstmswr.exe
File opened (read-only)	\??\m:	ajcvgeky.exe
File opened (read-only)	\??\s:	ajcvgeky.exe
File opened (read-only)	\??\v:	ajcvgeky.exe
File opened (read-only)	\??\x:	ajcvgeky.exe
File opened (read-only)	\??\h:	bnixstmswr.exe
File opened (read-only)	\??\i:	bnixstmswr.exe
File opened (read-only)	\??\b:	ajcvgeky.exe
File opened (read-only)	\??\i:	ajcvgeky.exe
File opened (read-only)	\??\k:	ajcvgeky.exe
File opened (read-only)	\??\l:	ajcvgeky.exe
File opened (read-only)	\??\a:	ajcvgeky.exe
File opened (read-only)	\??\x:	ajcvgeky.exe
File opened (read-only)	\??\z:	ajcvgeky.exe
File opened (read-only)	\??\j:	ajcvgeky.exe
File opened (read-only)	\??\z:	ajcvgeky.exe
File opened (read-only)	\??\v:	bnixstmswr.exe
File opened (read-only)	\??\g:	ajcvgeky.exe
File opened (read-only)	\??\u:	ajcvgeky.exe
File opened (read-only)	\??\f:	bnixstmswr.exe
File opened (read-only)	\??\o:	bnixstmswr.exe
File opened (read-only)	\??\p:	bnixstmswr.exe
File opened (read-only)	\??\t:	ajcvgeky.exe
File opened (read-only)	\??\k:	ajcvgeky.exe
File opened (read-only)	\??\s:	bnixstmswr.exe
File opened (read-only)	\??\w:	bnixstmswr.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

bnixstmswr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	bnixstmswr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	bnixstmswr.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1104-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/936-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1176-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1376-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/520-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1488-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1104-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/936-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1176-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1376-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/520-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1488-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1488-102-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1376-103-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exebnixstmswr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\kwyljbkceyeovsy.exe	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
File opened for modification	C:\Windows\SysWOW64\ajcvgeky.exe	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
File created	C:\Windows\SysWOW64\jjsotrcxbdbts.exe	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
File opened for modification	C:\Windows\SysWOW64\jjsotrcxbdbts.exe	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
File opened for modification	C:\Windows\SysWOW64\bnixstmswr.exe	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
File created	C:\Windows\SysWOW64\kwyljbkceyeovsy.exe	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	bnixstmswr.exe
File created	C:\Windows\SysWOW64\bnixstmswr.exe	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
File created	C:\Windows\SysWOW64\ajcvgeky.exe	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe

Drops file in Program Files directory 28 IoCs

Processes:

ajcvgeky.exeajcvgeky.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ajcvgeky.exe
File opened for modification	C:\Program Files\EditUnprotect.doc.exe	ajcvgeky.exe
File created	\??\c:\Program Files\EnterTrace.doc.exe	ajcvgeky.exe
File opened for modification	\??\c:\Program Files\EnterTrace.doc.exe	ajcvgeky.exe
File opened for modification	C:\Program Files\EnterTrace.nal	ajcvgeky.exe
File opened for modification	\??\c:\Program Files\EnterTrace.doc.exe	ajcvgeky.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	ajcvgeky.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	ajcvgeky.exe
File created	\??\c:\Program Files\EditUnprotect.doc.exe	ajcvgeky.exe
File opened for modification	C:\Program Files\EditUnprotect.doc.exe	ajcvgeky.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ajcvgeky.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ajcvgeky.exe
File opened for modification	\??\c:\Program Files\EditUnprotect.doc.exe	ajcvgeky.exe
File opened for modification	C:\Program Files\EditUnprotect.nal	ajcvgeky.exe
File opened for modification	C:\Program Files\EnterTrace.nal	ajcvgeky.exe
File opened for modification	C:\Program Files\EnterTrace.doc.exe	ajcvgeky.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	ajcvgeky.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ajcvgeky.exe
File opened for modification	C:\Program Files\EditUnprotect.nal	ajcvgeky.exe
File opened for modification	C:\Program Files\EnterTrace.doc.exe	ajcvgeky.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ajcvgeky.exe
File opened for modification	\??\c:\Program Files\EditUnprotect.doc.exe	ajcvgeky.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ajcvgeky.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ajcvgeky.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ajcvgeky.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ajcvgeky.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ajcvgeky.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	ajcvgeky.exe

Drops file in Windows directory 4 IoCs

Processes:

d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

bnixstmswr.exeWINWORD.EXEd7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	bnixstmswr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFBFF8D4F5A851E903CD65A7D96BCE5E130594367456243D6EE"	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	bnixstmswr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	bnixstmswr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	bnixstmswr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	bnixstmswr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABEF9CAFE64F195837A3B4386E93992B08A03FD43140349E2C8459C09A3"	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FCAB1204794389D53C9BAD7329ED4CF"	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

364 WINWORD.EXE

pid	process
364	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exebnixstmswr.exekwyljbkceyeovsy.exeajcvgeky.exejjsotrcxbdbts.exeajcvgeky.exe

pid	process
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
936	bnixstmswr.exe
936	bnixstmswr.exe
936	bnixstmswr.exe
936	bnixstmswr.exe
936	bnixstmswr.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
1376	ajcvgeky.exe
1376	ajcvgeky.exe
1376	ajcvgeky.exe
1376	ajcvgeky.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1488	ajcvgeky.exe
1488	ajcvgeky.exe
1488	ajcvgeky.exe
1488	ajcvgeky.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1176	kwyljbkceyeovsy.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

548 explorer.exe

pid	process
548	explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe
Token: 33	604	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	604	AUDIODG.EXE
Token: 33	604	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	604	AUDIODG.EXE
Token: SeShutdownPrivilege	548	explorer.exe
Token: SeShutdownPrivilege	548	explorer.exe

Suspicious use of FindShellTrayWindow 44 IoCs

Processes:

d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exebnixstmswr.exekwyljbkceyeovsy.exeajcvgeky.exejjsotrcxbdbts.exeajcvgeky.exeexplorer.exe

pid	process
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
936	bnixstmswr.exe
936	bnixstmswr.exe
936	bnixstmswr.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
1376	ajcvgeky.exe
1376	ajcvgeky.exe
1376	ajcvgeky.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1488	ajcvgeky.exe
1488	ajcvgeky.exe
1488	ajcvgeky.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe

Suspicious use of SendNotifyMessage 37 IoCs

Processes:

d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exebnixstmswr.exekwyljbkceyeovsy.exeajcvgeky.exejjsotrcxbdbts.exeajcvgeky.exeexplorer.exe

pid	process
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
936	bnixstmswr.exe
936	bnixstmswr.exe
936	bnixstmswr.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
1176	kwyljbkceyeovsy.exe
1376	ajcvgeky.exe
1376	ajcvgeky.exe
1376	ajcvgeky.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
520	jjsotrcxbdbts.exe
1488	ajcvgeky.exe
1488	ajcvgeky.exe
1488	ajcvgeky.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe
548	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

364 WINWORD.EXE
364 WINWORD.EXE

pid	process
364	WINWORD.EXE
364	WINWORD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exebnixstmswr.exe

description	pid	process	target process
PID 1104 wrote to memory of 936	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	bnixstmswr.exe
PID 1104 wrote to memory of 936	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	bnixstmswr.exe
PID 1104 wrote to memory of 936	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	bnixstmswr.exe
PID 1104 wrote to memory of 936	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	bnixstmswr.exe
PID 1104 wrote to memory of 1176	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	kwyljbkceyeovsy.exe
PID 1104 wrote to memory of 1176	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	kwyljbkceyeovsy.exe
PID 1104 wrote to memory of 1176	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	kwyljbkceyeovsy.exe
PID 1104 wrote to memory of 1176	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	kwyljbkceyeovsy.exe
PID 1104 wrote to memory of 1376	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	ajcvgeky.exe
PID 1104 wrote to memory of 1376	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	ajcvgeky.exe
PID 1104 wrote to memory of 1376	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	ajcvgeky.exe
PID 1104 wrote to memory of 1376	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	ajcvgeky.exe
PID 1104 wrote to memory of 520	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	jjsotrcxbdbts.exe
PID 1104 wrote to memory of 520	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	jjsotrcxbdbts.exe
PID 1104 wrote to memory of 520	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	jjsotrcxbdbts.exe
PID 1104 wrote to memory of 520	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	jjsotrcxbdbts.exe
PID 936 wrote to memory of 1488	936	bnixstmswr.exe	ajcvgeky.exe
PID 936 wrote to memory of 1488	936	bnixstmswr.exe	ajcvgeky.exe
PID 936 wrote to memory of 1488	936	bnixstmswr.exe	ajcvgeky.exe
PID 936 wrote to memory of 1488	936	bnixstmswr.exe	ajcvgeky.exe
PID 1104 wrote to memory of 364	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	WINWORD.EXE
PID 1104 wrote to memory of 364	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	WINWORD.EXE
PID 1104 wrote to memory of 364	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	WINWORD.EXE
PID 1104 wrote to memory of 364	1104	d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
"C:\Users\Admin\AppData\Local\Temp\d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\bnixstmswr.exe
bnixstmswr.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\SysWOW64\ajcvgeky.exe
C:\Windows\system32\ajcvgeky.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1488

C:\Windows\SysWOW64\kwyljbkceyeovsy.exe
kwyljbkceyeovsy.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1176

C:\Windows\SysWOW64\ajcvgeky.exe
ajcvgeky.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1376

C:\Windows\SysWOW64\jjsotrcxbdbts.exe
jjsotrcxbdbts.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:520

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:364

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:548

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x588
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:604

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\EnterTrace.doc.exe
Filesize
255KB

MD5
192337c8b35a591458fbb913fb393084

SHA1
bc20e7d349c76588c824c338d324c2fc3256e1c1

SHA256
256bc1d3c36f39c4faa047bba45ef0536f3a58eba3ee3fe97ff606f26cee93a7

SHA512
5295203113273d8d84ac23b1a0881f473ea7f5fe534daee54d8c18b5f977c6cc76e3f7b5793b4b7c1cbeef15f4a06fa81f9eee4a5e0d61761461831900da4386

Download Submit
C:\Windows\SysWOW64\ajcvgeky.exe
Filesize
255KB

MD5
b6179e0f025fa938972bb2845848ee83

SHA1
160418df94bfbb07bc69c013ac8186acca6d46cf

SHA256
9f055c2c35b2cd389a312159e440e03d39b68f9bcef7de4edfd9dcd234ea6274

SHA512
e649a4e886fbb5adb7b2eaa17bf0a398ba1694fde5754aa801a64589a5b04599b5f60eb65764f919f4c56ea1e91491ea1ba06aa41a0ab965415456acc19673ff

Download Submit
C:\Windows\SysWOW64\ajcvgeky.exe
Filesize
255KB

MD5
b6179e0f025fa938972bb2845848ee83

SHA1
160418df94bfbb07bc69c013ac8186acca6d46cf

SHA256
9f055c2c35b2cd389a312159e440e03d39b68f9bcef7de4edfd9dcd234ea6274

SHA512
e649a4e886fbb5adb7b2eaa17bf0a398ba1694fde5754aa801a64589a5b04599b5f60eb65764f919f4c56ea1e91491ea1ba06aa41a0ab965415456acc19673ff

Download Submit
C:\Windows\SysWOW64\ajcvgeky.exe
Filesize
255KB

MD5
b6179e0f025fa938972bb2845848ee83

SHA1
160418df94bfbb07bc69c013ac8186acca6d46cf

SHA256
9f055c2c35b2cd389a312159e440e03d39b68f9bcef7de4edfd9dcd234ea6274

SHA512
e649a4e886fbb5adb7b2eaa17bf0a398ba1694fde5754aa801a64589a5b04599b5f60eb65764f919f4c56ea1e91491ea1ba06aa41a0ab965415456acc19673ff

Download Submit
C:\Windows\SysWOW64\bnixstmswr.exe
Filesize
255KB

MD5
82be0177cf6e947c4378e98c9c22a2da

SHA1
1046235170a87f11c06c445fdb19261814fade3a

SHA256
00a083c4582c5252cdf9996dffa30fc5bf3eb6ad41e6d8ecc4133418bab29dc0

SHA512
f83f0f5c2e9be36c851bcd659fb710c20edde8cce732986b655376defb0345280f485f466844fe82bfe3c3bc5e17ffac3b21c577f15f848505407173df0ab03f

Download Submit
C:\Windows\SysWOW64\bnixstmswr.exe
Filesize
255KB

MD5
82be0177cf6e947c4378e98c9c22a2da

SHA1
1046235170a87f11c06c445fdb19261814fade3a

SHA256
00a083c4582c5252cdf9996dffa30fc5bf3eb6ad41e6d8ecc4133418bab29dc0

SHA512
f83f0f5c2e9be36c851bcd659fb710c20edde8cce732986b655376defb0345280f485f466844fe82bfe3c3bc5e17ffac3b21c577f15f848505407173df0ab03f

Download Submit
C:\Windows\SysWOW64\jjsotrcxbdbts.exe
Filesize
255KB

MD5
db7a15f18ff2e073858cbfb2e4538768

SHA1
1d07b50f0349bbf41f524f1a7dc046122cdb42e9

SHA256
f7d65df527231c3570188f8d28114056decceefb64aa3f9c1084ce58cd0abb8f

SHA512
71bdb7551386fad368315a66c434bc6f1e13b3f7c527bc34b370c81f2fcb08f8b96c4e7406de5ec8649f8e8c5b8279843a2cb0252c4754b58cdecbec13cc1ffd

Download Submit
C:\Windows\SysWOW64\jjsotrcxbdbts.exe
Filesize
255KB

MD5
db7a15f18ff2e073858cbfb2e4538768

SHA1
1d07b50f0349bbf41f524f1a7dc046122cdb42e9

SHA256
f7d65df527231c3570188f8d28114056decceefb64aa3f9c1084ce58cd0abb8f

SHA512
71bdb7551386fad368315a66c434bc6f1e13b3f7c527bc34b370c81f2fcb08f8b96c4e7406de5ec8649f8e8c5b8279843a2cb0252c4754b58cdecbec13cc1ffd

Download Submit
C:\Windows\SysWOW64\kwyljbkceyeovsy.exe
Filesize
255KB

MD5
116e4545c8769f909fc1814ffa9b0362

SHA1
ce6e497da449acf5d9258634fe389336aab1e414

SHA256
91d29389c0e1263b49c9b2e6cbbfe0040f3b76aa991520d47adbb08910ef9ff1

SHA512
7545de3af898e4fff0d2836ca6ce77195fed2027d451c8c86010dff7d306d9bb4cc34cb39e9b9cf2efde6f6725c8460e89842667d8b11578a6bfb9113133d1dc

Download Submit
C:\Windows\SysWOW64\kwyljbkceyeovsy.exe
Filesize
255KB

MD5
116e4545c8769f909fc1814ffa9b0362

SHA1
ce6e497da449acf5d9258634fe389336aab1e414

SHA256
91d29389c0e1263b49c9b2e6cbbfe0040f3b76aa991520d47adbb08910ef9ff1

SHA512
7545de3af898e4fff0d2836ca6ce77195fed2027d451c8c86010dff7d306d9bb4cc34cb39e9b9cf2efde6f6725c8460e89842667d8b11578a6bfb9113133d1dc

Download Submit
C:\Windows\mydoc.rtf
Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\ajcvgeky.exe
Filesize
255KB

MD5
b6179e0f025fa938972bb2845848ee83

SHA1
160418df94bfbb07bc69c013ac8186acca6d46cf

SHA256
9f055c2c35b2cd389a312159e440e03d39b68f9bcef7de4edfd9dcd234ea6274

SHA512
e649a4e886fbb5adb7b2eaa17bf0a398ba1694fde5754aa801a64589a5b04599b5f60eb65764f919f4c56ea1e91491ea1ba06aa41a0ab965415456acc19673ff

Download Submit
\Windows\SysWOW64\ajcvgeky.exe
Filesize
255KB

MD5
b6179e0f025fa938972bb2845848ee83

SHA1
160418df94bfbb07bc69c013ac8186acca6d46cf

SHA256
9f055c2c35b2cd389a312159e440e03d39b68f9bcef7de4edfd9dcd234ea6274

SHA512
e649a4e886fbb5adb7b2eaa17bf0a398ba1694fde5754aa801a64589a5b04599b5f60eb65764f919f4c56ea1e91491ea1ba06aa41a0ab965415456acc19673ff

Download Submit
\Windows\SysWOW64\bnixstmswr.exe
Filesize
255KB

MD5
82be0177cf6e947c4378e98c9c22a2da

SHA1
1046235170a87f11c06c445fdb19261814fade3a

SHA256
00a083c4582c5252cdf9996dffa30fc5bf3eb6ad41e6d8ecc4133418bab29dc0

SHA512
f83f0f5c2e9be36c851bcd659fb710c20edde8cce732986b655376defb0345280f485f466844fe82bfe3c3bc5e17ffac3b21c577f15f848505407173df0ab03f

Download Submit
\Windows\SysWOW64\jjsotrcxbdbts.exe
Filesize
255KB

MD5
db7a15f18ff2e073858cbfb2e4538768

SHA1
1d07b50f0349bbf41f524f1a7dc046122cdb42e9

SHA256
f7d65df527231c3570188f8d28114056decceefb64aa3f9c1084ce58cd0abb8f

SHA512
71bdb7551386fad368315a66c434bc6f1e13b3f7c527bc34b370c81f2fcb08f8b96c4e7406de5ec8649f8e8c5b8279843a2cb0252c4754b58cdecbec13cc1ffd

Download Submit
\Windows\SysWOW64\kwyljbkceyeovsy.exe
Filesize
255KB

MD5
116e4545c8769f909fc1814ffa9b0362

SHA1
ce6e497da449acf5d9258634fe389336aab1e414

SHA256
91d29389c0e1263b49c9b2e6cbbfe0040f3b76aa991520d47adbb08910ef9ff1

SHA512
7545de3af898e4fff0d2836ca6ce77195fed2027d451c8c86010dff7d306d9bb4cc34cb39e9b9cf2efde6f6725c8460e89842667d8b11578a6bfb9113133d1dc

Download Submit
memory/364-91-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/364-101-0x000000007130D000-0x0000000071318000-memory.dmp

Filesize
44KB

Download
memory/364-87-0x0000000000000000-mapping.dmp

Download
memory/364-90-0x0000000070321000-0x0000000070323000-memory.dmp

Filesize
8KB

Download
memory/364-89-0x00000000728A1000-0x00000000728A4000-memory.dmp

Filesize
12KB

Download
memory/364-94-0x000000007130D000-0x0000000071318000-memory.dmp

Filesize
44KB

Download
memory/520-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/520-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/520-71-0x0000000000000000-mapping.dmp

Download
memory/548-95-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/548-104-0x0000000002650000-0x0000000002660000-memory.dmp

Filesize
64KB

Download
memory/936-56-0x0000000000000000-mapping.dmp

Download
memory/936-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/936-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1104-80-0x0000000002FD0000-0x0000000003070000-memory.dmp

Filesize
640KB

Download
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1104-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1104-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1176-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1176-61-0x0000000000000000-mapping.dmp

Download
memory/1176-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1376-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1376-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1376-103-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1376-65-0x0000000000000000-mapping.dmp

Download
memory/1488-102-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1488-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1488-75-0x0000000000000000-mapping.dmp

Download
memory/1488-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads