Analysis
-
max time kernel
152s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 23:03
Behavioral task
behavioral1
Sample
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe
Resource
win7-20220812-en
General
-
Target
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe
-
Size
255KB
-
MD5
cd742cdb95eedee3e635cda77709c40c
-
SHA1
330e49f4db8a90733a28a77597efe1baff38ba37
-
SHA256
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d
-
SHA512
06ec4ee70d7333811d73ed9116c6517f207428884e2a54a9f9684c6cb45afd89681beff07f754099ca2e6a7e898b92040fc03d13b7e625056d575f62114f71ed
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJn:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI0
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
kfitagmbdb.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" kfitagmbdb.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
kfitagmbdb.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kfitagmbdb.exe -
Processes:
kfitagmbdb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kfitagmbdb.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
kfitagmbdb.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kfitagmbdb.exe -
Executes dropped EXE 5 IoCs
Processes:
kfitagmbdb.exeqfawegihzqfqnrw.exekjhvywos.exedypkxbqqwvezn.exekjhvywos.exepid process 1432 kfitagmbdb.exe 1076 qfawegihzqfqnrw.exe 2024 kjhvywos.exe 1992 dypkxbqqwvezn.exe 1996 kjhvywos.exe -
Processes:
resource yara_rule \Windows\SysWOW64\kfitagmbdb.exe upx C:\Windows\SysWOW64\kfitagmbdb.exe upx C:\Windows\SysWOW64\kfitagmbdb.exe upx \Windows\SysWOW64\qfawegihzqfqnrw.exe upx behavioral1/memory/1504-62-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1432-64-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\qfawegihzqfqnrw.exe upx \Windows\SysWOW64\kjhvywos.exe upx C:\Windows\SysWOW64\kjhvywos.exe upx C:\Windows\SysWOW64\qfawegihzqfqnrw.exe upx \Windows\SysWOW64\dypkxbqqwvezn.exe upx C:\Windows\SysWOW64\dypkxbqqwvezn.exe upx C:\Windows\SysWOW64\kjhvywos.exe upx C:\Windows\SysWOW64\dypkxbqqwvezn.exe upx C:\Windows\SysWOW64\kjhvywos.exe upx \Windows\SysWOW64\kjhvywos.exe upx behavioral1/memory/1076-82-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2024-83-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1992-84-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1996-85-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1504-87-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1432-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1076-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/2024-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1992-97-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1996-98-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe upx C:\Users\Admin\Documents\UnregisterApprove.doc.exe upx -
Loads dropped DLL 5 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exekfitagmbdb.exepid process 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1432 kfitagmbdb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
kfitagmbdb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" kfitagmbdb.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
qfawegihzqfqnrw.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "dypkxbqqwvezn.exe" qfawegihzqfqnrw.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run qfawegihzqfqnrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dqwfagol = "kfitagmbdb.exe" qfawegihzqfqnrw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gleqdrel = "qfawegihzqfqnrw.exe" qfawegihzqfqnrw.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
kjhvywos.exekfitagmbdb.exekjhvywos.exedescription ioc process File opened (read-only) \??\f: kjhvywos.exe File opened (read-only) \??\m: kfitagmbdb.exe File opened (read-only) \??\k: kjhvywos.exe File opened (read-only) \??\i: kjhvywos.exe File opened (read-only) \??\t: kjhvywos.exe File opened (read-only) \??\s: kfitagmbdb.exe File opened (read-only) \??\t: kfitagmbdb.exe File opened (read-only) \??\o: kfitagmbdb.exe File opened (read-only) \??\g: kjhvywos.exe File opened (read-only) \??\o: kjhvywos.exe File opened (read-only) \??\z: kjhvywos.exe File opened (read-only) \??\e: kfitagmbdb.exe File opened (read-only) \??\h: kfitagmbdb.exe File opened (read-only) \??\j: kfitagmbdb.exe File opened (read-only) \??\a: kjhvywos.exe File opened (read-only) \??\j: kjhvywos.exe File opened (read-only) \??\m: kjhvywos.exe File opened (read-only) \??\s: kjhvywos.exe File opened (read-only) \??\q: kjhvywos.exe File opened (read-only) \??\x: kjhvywos.exe File opened (read-only) \??\l: kfitagmbdb.exe File opened (read-only) \??\u: kfitagmbdb.exe File opened (read-only) \??\w: kfitagmbdb.exe File opened (read-only) \??\x: kfitagmbdb.exe File opened (read-only) \??\z: kfitagmbdb.exe File opened (read-only) \??\j: kjhvywos.exe File opened (read-only) \??\n: kjhvywos.exe File opened (read-only) \??\f: kfitagmbdb.exe File opened (read-only) \??\g: kfitagmbdb.exe File opened (read-only) \??\q: kjhvywos.exe File opened (read-only) \??\x: kjhvywos.exe File opened (read-only) \??\s: kjhvywos.exe File opened (read-only) \??\w: kjhvywos.exe File opened (read-only) \??\k: kfitagmbdb.exe File opened (read-only) \??\v: kfitagmbdb.exe File opened (read-only) \??\t: kjhvywos.exe File opened (read-only) \??\e: kjhvywos.exe File opened (read-only) \??\v: kjhvywos.exe File opened (read-only) \??\q: kfitagmbdb.exe File opened (read-only) \??\b: kjhvywos.exe File opened (read-only) \??\i: kjhvywos.exe File opened (read-only) \??\n: kjhvywos.exe File opened (read-only) \??\u: kjhvywos.exe File opened (read-only) \??\z: kjhvywos.exe File opened (read-only) \??\k: kjhvywos.exe File opened (read-only) \??\b: kfitagmbdb.exe File opened (read-only) \??\n: kfitagmbdb.exe File opened (read-only) \??\f: kjhvywos.exe File opened (read-only) \??\u: kjhvywos.exe File opened (read-only) \??\l: kjhvywos.exe File opened (read-only) \??\w: kjhvywos.exe File opened (read-only) \??\a: kjhvywos.exe File opened (read-only) \??\b: kjhvywos.exe File opened (read-only) \??\l: kjhvywos.exe File opened (read-only) \??\p: kjhvywos.exe File opened (read-only) \??\h: kjhvywos.exe File opened (read-only) \??\o: kjhvywos.exe File opened (read-only) \??\y: kjhvywos.exe File opened (read-only) \??\y: kfitagmbdb.exe File opened (read-only) \??\h: kjhvywos.exe File opened (read-only) \??\v: kjhvywos.exe File opened (read-only) \??\m: kjhvywos.exe File opened (read-only) \??\i: kfitagmbdb.exe File opened (read-only) \??\r: kfitagmbdb.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
kfitagmbdb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" kfitagmbdb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" kfitagmbdb.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1504-62-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1432-64-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1076-82-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2024-83-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1992-84-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1996-85-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1504-87-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1432-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1076-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/2024-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1992-97-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1996-98-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exekfitagmbdb.exedescription ioc process File created C:\Windows\SysWOW64\qfawegihzqfqnrw.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\SysWOW64\qfawegihzqfqnrw.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File created C:\Windows\SysWOW64\kfitagmbdb.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\SysWOW64\kfitagmbdb.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File created C:\Windows\SysWOW64\kjhvywos.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\SysWOW64\kjhvywos.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File created C:\Windows\SysWOW64\dypkxbqqwvezn.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\SysWOW64\dypkxbqqwvezn.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll kfitagmbdb.exe -
Drops file in Program Files directory 14 IoCs
Processes:
kjhvywos.exekjhvywos.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe kjhvywos.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe kjhvywos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal kjhvywos.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe kjhvywos.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe kjhvywos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe kjhvywos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe kjhvywos.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe kjhvywos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal kjhvywos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe kjhvywos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal kjhvywos.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe kjhvywos.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe kjhvywos.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal kjhvywos.exe -
Drops file in Windows directory 5 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXE61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exekfitagmbdb.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BB4FAC9F917F2E783753B4686EB3999B3FC038A43150238E1BF459B09D4" 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh kfitagmbdb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33332C7E9C2082206A4676D770542CDC7DF364DB" 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F568B4FF1A21DED208D0A98A0F9166" 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1524 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exekfitagmbdb.exeqfawegihzqfqnrw.exekjhvywos.exedypkxbqqwvezn.exekjhvywos.exepid process 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1432 kfitagmbdb.exe 1432 kfitagmbdb.exe 1432 kfitagmbdb.exe 1432 kfitagmbdb.exe 1432 kfitagmbdb.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 2024 kjhvywos.exe 2024 kjhvywos.exe 2024 kjhvywos.exe 2024 kjhvywos.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1996 kjhvywos.exe 1996 kjhvywos.exe 1996 kjhvywos.exe 1996 kjhvywos.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1076 qfawegihzqfqnrw.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exekfitagmbdb.exeqfawegihzqfqnrw.exekjhvywos.exedypkxbqqwvezn.exekjhvywos.exepid process 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1432 kfitagmbdb.exe 1432 kfitagmbdb.exe 1432 kfitagmbdb.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 2024 kjhvywos.exe 2024 kjhvywos.exe 2024 kjhvywos.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1996 kjhvywos.exe 1996 kjhvywos.exe 1996 kjhvywos.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exekfitagmbdb.exeqfawegihzqfqnrw.exekjhvywos.exedypkxbqqwvezn.exekjhvywos.exepid process 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1432 kfitagmbdb.exe 1432 kfitagmbdb.exe 1432 kfitagmbdb.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 1076 qfawegihzqfqnrw.exe 2024 kjhvywos.exe 2024 kjhvywos.exe 2024 kjhvywos.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1992 dypkxbqqwvezn.exe 1996 kjhvywos.exe 1996 kjhvywos.exe 1996 kjhvywos.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1524 WINWORD.EXE 1524 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exekfitagmbdb.exeWINWORD.EXEdescription pid process target process PID 1504 wrote to memory of 1432 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kfitagmbdb.exe PID 1504 wrote to memory of 1432 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kfitagmbdb.exe PID 1504 wrote to memory of 1432 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kfitagmbdb.exe PID 1504 wrote to memory of 1432 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kfitagmbdb.exe PID 1504 wrote to memory of 1076 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe qfawegihzqfqnrw.exe PID 1504 wrote to memory of 1076 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe qfawegihzqfqnrw.exe PID 1504 wrote to memory of 1076 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe qfawegihzqfqnrw.exe PID 1504 wrote to memory of 1076 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe qfawegihzqfqnrw.exe PID 1504 wrote to memory of 2024 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kjhvywos.exe PID 1504 wrote to memory of 2024 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kjhvywos.exe PID 1504 wrote to memory of 2024 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kjhvywos.exe PID 1504 wrote to memory of 2024 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kjhvywos.exe PID 1504 wrote to memory of 1992 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe dypkxbqqwvezn.exe PID 1504 wrote to memory of 1992 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe dypkxbqqwvezn.exe PID 1504 wrote to memory of 1992 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe dypkxbqqwvezn.exe PID 1504 wrote to memory of 1992 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe dypkxbqqwvezn.exe PID 1432 wrote to memory of 1996 1432 kfitagmbdb.exe kjhvywos.exe PID 1432 wrote to memory of 1996 1432 kfitagmbdb.exe kjhvywos.exe PID 1432 wrote to memory of 1996 1432 kfitagmbdb.exe kjhvywos.exe PID 1432 wrote to memory of 1996 1432 kfitagmbdb.exe kjhvywos.exe PID 1504 wrote to memory of 1524 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe WINWORD.EXE PID 1504 wrote to memory of 1524 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe WINWORD.EXE PID 1504 wrote to memory of 1524 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe WINWORD.EXE PID 1504 wrote to memory of 1524 1504 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe WINWORD.EXE PID 1524 wrote to memory of 1604 1524 WINWORD.EXE splwow64.exe PID 1524 wrote to memory of 1604 1524 WINWORD.EXE splwow64.exe PID 1524 wrote to memory of 1604 1524 WINWORD.EXE splwow64.exe PID 1524 wrote to memory of 1604 1524 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe"C:\Users\Admin\AppData\Local\Temp\61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\kfitagmbdb.exekfitagmbdb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\kjhvywos.exeC:\Windows\system32\kjhvywos.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\qfawegihzqfqnrw.exeqfawegihzqfqnrw.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\kjhvywos.exekjhvywos.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\dypkxbqqwvezn.exedypkxbqqwvezn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
7Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exeFilesize
255KB
MD565f4edd6bd50ea128cde678b3e691e8d
SHA1bd8d43a3f3720feb881b163fc71a33c93f9eb1cc
SHA256cd898573272657a7af7e95eeca1e9908b61632ba1da0acff67a3270e49add94b
SHA512a0dbfca6f864d0ec280e3e759bcd8ab8354a1ff07f03bb09c8f91c29097f617eab4637470c2ccf73f813d1789f8f2887bde59a8619d049c0b24ce4c7de7e8979
-
C:\Users\Admin\Documents\UnregisterApprove.doc.exeFilesize
255KB
MD5d738822c9f35d401d799281dbcc1525d
SHA1307db8527c7ddbdbc2fe1bde1e02f170c150ae4c
SHA2567d3200d69aa5321159cf24bd2b316f2279b5ae5a29ce23afe31ea95bd825f2e9
SHA512407a8c5cc07eaf543a5ba10f086e8879d6b0c9ad78b0ef93958b3b26d940e30fdc4da5ce0556a7418d5e2f5b0d6008f54e0aea639ecf22d3c10f8b2923e9e88e
-
C:\Windows\SysWOW64\dypkxbqqwvezn.exeFilesize
255KB
MD558ed8809ab7e58f899e63949bd5dba44
SHA17c26f3ca4cff30d7ab4f7c1194d185543042f848
SHA256ef94e2eb9711e29b0a5d876facd8091e75a9e62104d8008dac88b4367c140593
SHA5127cc5d0eb01d8ad8efeebe03f0849f3315d033b56163057d12237437854f40b77060bb35d057a572538de45abb63a1f697c12176f00b7681875fb1df460036f0f
-
C:\Windows\SysWOW64\dypkxbqqwvezn.exeFilesize
255KB
MD558ed8809ab7e58f899e63949bd5dba44
SHA17c26f3ca4cff30d7ab4f7c1194d185543042f848
SHA256ef94e2eb9711e29b0a5d876facd8091e75a9e62104d8008dac88b4367c140593
SHA5127cc5d0eb01d8ad8efeebe03f0849f3315d033b56163057d12237437854f40b77060bb35d057a572538de45abb63a1f697c12176f00b7681875fb1df460036f0f
-
C:\Windows\SysWOW64\kfitagmbdb.exeFilesize
255KB
MD50fcf1268d8678395dbfbd17f062d6281
SHA1753d08d683cb347994fa0f0d101c1357f78ecd6a
SHA2566f7b221f1806bf23a4c94f5d19530a13238be4795e868beb432ef10c8dc06f48
SHA5125ac1e1719f4bb3ef7257d4cae60695f06bc49942b120cbc4468945fc4dea08f5de5211a8491a6bd00b1b45740963e5a4f4235f3f006edfbe187c74fd467d95fd
-
C:\Windows\SysWOW64\kfitagmbdb.exeFilesize
255KB
MD50fcf1268d8678395dbfbd17f062d6281
SHA1753d08d683cb347994fa0f0d101c1357f78ecd6a
SHA2566f7b221f1806bf23a4c94f5d19530a13238be4795e868beb432ef10c8dc06f48
SHA5125ac1e1719f4bb3ef7257d4cae60695f06bc49942b120cbc4468945fc4dea08f5de5211a8491a6bd00b1b45740963e5a4f4235f3f006edfbe187c74fd467d95fd
-
C:\Windows\SysWOW64\kjhvywos.exeFilesize
255KB
MD54bd047180072785d6a02e4ea9b4565a3
SHA14e9a196264f9cded49f24688f30f54683df99f28
SHA2565976afb1617ba175a7a6f9acfb4a64b8a3aeb60726a4915be58bcf1fb31d0a9c
SHA5125bb58b8711de3762c3d62094a63772c52a72475779d5d85d6ab10dacbe0b7842bcb3b3073f8d92724c6a7590bc58db0b12d9da573b3dad5aa6b82ee32c65222d
-
C:\Windows\SysWOW64\kjhvywos.exeFilesize
255KB
MD54bd047180072785d6a02e4ea9b4565a3
SHA14e9a196264f9cded49f24688f30f54683df99f28
SHA2565976afb1617ba175a7a6f9acfb4a64b8a3aeb60726a4915be58bcf1fb31d0a9c
SHA5125bb58b8711de3762c3d62094a63772c52a72475779d5d85d6ab10dacbe0b7842bcb3b3073f8d92724c6a7590bc58db0b12d9da573b3dad5aa6b82ee32c65222d
-
C:\Windows\SysWOW64\kjhvywos.exeFilesize
255KB
MD54bd047180072785d6a02e4ea9b4565a3
SHA14e9a196264f9cded49f24688f30f54683df99f28
SHA2565976afb1617ba175a7a6f9acfb4a64b8a3aeb60726a4915be58bcf1fb31d0a9c
SHA5125bb58b8711de3762c3d62094a63772c52a72475779d5d85d6ab10dacbe0b7842bcb3b3073f8d92724c6a7590bc58db0b12d9da573b3dad5aa6b82ee32c65222d
-
C:\Windows\SysWOW64\qfawegihzqfqnrw.exeFilesize
255KB
MD51ec6578742c8f5e801d89966641931d7
SHA17185c0f631e6c4974194082902edc368dee88ab2
SHA256a3eff70a9b31e3c003443db3a479998248a9b0b4c38e31a82e8e220c8960565d
SHA5129ef542bb09c175eaebabc52a02166082d18f00431596779088a449d9e6bec287922b2d5f54ab63ce8951333f6bffcd5d2fce7ac2755a8399ae4007d0c4aefaa7
-
C:\Windows\SysWOW64\qfawegihzqfqnrw.exeFilesize
255KB
MD51ec6578742c8f5e801d89966641931d7
SHA17185c0f631e6c4974194082902edc368dee88ab2
SHA256a3eff70a9b31e3c003443db3a479998248a9b0b4c38e31a82e8e220c8960565d
SHA5129ef542bb09c175eaebabc52a02166082d18f00431596779088a449d9e6bec287922b2d5f54ab63ce8951333f6bffcd5d2fce7ac2755a8399ae4007d0c4aefaa7
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\Windows\SysWOW64\dypkxbqqwvezn.exeFilesize
255KB
MD558ed8809ab7e58f899e63949bd5dba44
SHA17c26f3ca4cff30d7ab4f7c1194d185543042f848
SHA256ef94e2eb9711e29b0a5d876facd8091e75a9e62104d8008dac88b4367c140593
SHA5127cc5d0eb01d8ad8efeebe03f0849f3315d033b56163057d12237437854f40b77060bb35d057a572538de45abb63a1f697c12176f00b7681875fb1df460036f0f
-
\Windows\SysWOW64\kfitagmbdb.exeFilesize
255KB
MD50fcf1268d8678395dbfbd17f062d6281
SHA1753d08d683cb347994fa0f0d101c1357f78ecd6a
SHA2566f7b221f1806bf23a4c94f5d19530a13238be4795e868beb432ef10c8dc06f48
SHA5125ac1e1719f4bb3ef7257d4cae60695f06bc49942b120cbc4468945fc4dea08f5de5211a8491a6bd00b1b45740963e5a4f4235f3f006edfbe187c74fd467d95fd
-
\Windows\SysWOW64\kjhvywos.exeFilesize
255KB
MD54bd047180072785d6a02e4ea9b4565a3
SHA14e9a196264f9cded49f24688f30f54683df99f28
SHA2565976afb1617ba175a7a6f9acfb4a64b8a3aeb60726a4915be58bcf1fb31d0a9c
SHA5125bb58b8711de3762c3d62094a63772c52a72475779d5d85d6ab10dacbe0b7842bcb3b3073f8d92724c6a7590bc58db0b12d9da573b3dad5aa6b82ee32c65222d
-
\Windows\SysWOW64\kjhvywos.exeFilesize
255KB
MD54bd047180072785d6a02e4ea9b4565a3
SHA14e9a196264f9cded49f24688f30f54683df99f28
SHA2565976afb1617ba175a7a6f9acfb4a64b8a3aeb60726a4915be58bcf1fb31d0a9c
SHA5125bb58b8711de3762c3d62094a63772c52a72475779d5d85d6ab10dacbe0b7842bcb3b3073f8d92724c6a7590bc58db0b12d9da573b3dad5aa6b82ee32c65222d
-
\Windows\SysWOW64\qfawegihzqfqnrw.exeFilesize
255KB
MD51ec6578742c8f5e801d89966641931d7
SHA17185c0f631e6c4974194082902edc368dee88ab2
SHA256a3eff70a9b31e3c003443db3a479998248a9b0b4c38e31a82e8e220c8960565d
SHA5129ef542bb09c175eaebabc52a02166082d18f00431596779088a449d9e6bec287922b2d5f54ab63ce8951333f6bffcd5d2fce7ac2755a8399ae4007d0c4aefaa7
-
memory/1076-61-0x0000000000000000-mapping.dmp
-
memory/1076-82-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1076-95-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1432-56-0x0000000000000000-mapping.dmp
-
memory/1432-64-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1432-94-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1504-87-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1504-63-0x0000000003290000-0x0000000003330000-memory.dmpFilesize
640KB
-
memory/1504-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1504-62-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1524-89-0x0000000070251000-0x0000000070253000-memory.dmpFilesize
8KB
-
memory/1524-86-0x0000000000000000-mapping.dmp
-
memory/1524-88-0x00000000727D1000-0x00000000727D4000-memory.dmpFilesize
12KB
-
memory/1524-90-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1524-103-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1524-93-0x000000007123D000-0x0000000071248000-memory.dmpFilesize
44KB
-
memory/1524-104-0x000000007123D000-0x0000000071248000-memory.dmpFilesize
44KB
-
memory/1604-101-0x0000000000000000-mapping.dmp
-
memory/1604-102-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmpFilesize
8KB
-
memory/1992-84-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1992-97-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1992-73-0x0000000000000000-mapping.dmp
-
memory/1996-98-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1996-79-0x0000000000000000-mapping.dmp
-
memory/1996-85-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2024-96-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2024-68-0x0000000000000000-mapping.dmp
-
memory/2024-83-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB