989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d

Analysis

max time kernel
154s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
Size

255KB
MD5

f83cef50ba75f3ffb08a8987465eb812
SHA1

d8efefbe1e85f57d7056605c55cbf2f0f483d5e5
SHA256

989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d
SHA512

4b5fe3eb0c9964cd4d108cd5b727af4f17f6c8b52a09bcb1255f904c9f7df0ad87e42b1dd4a696cacb59418caa2f1dc0d72c610cb71c88800744b2605c5aec73
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ/:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIS

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

wetdigkeql.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	wetdigkeql.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

wetdigkeql.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	wetdigkeql.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

wetdigkeql.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wetdigkeql.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

wetdigkeql.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wetdigkeql.exe

Executes dropped EXE 5 IoCs

Processes:

wetdigkeql.exehlndbrvczekafpg.exeselghfqh.exerejrqfgolwcvr.exeselghfqh.exe

pid process

1256 wetdigkeql.exe
1068 hlndbrvczekafpg.exe
580 selghfqh.exe
900 rejrqfgolwcvr.exe
1696 selghfqh.exe

pid	process
1256	wetdigkeql.exe
1068	hlndbrvczekafpg.exe
580	selghfqh.exe
900	rejrqfgolwcvr.exe
1696	selghfqh.exe

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1440-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\wetdigkeql.exe	upx
behavioral1/memory/1440-57-0x00000000022D0000-0x0000000002370000-memory.dmp	upx
behavioral1/memory/1440-58-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
\Windows\SysWOW64\hlndbrvczekafpg.exe	upx
C:\Windows\SysWOW64\wetdigkeql.exe	upx
\Windows\SysWOW64\selghfqh.exe	upx
C:\Windows\SysWOW64\hlndbrvczekafpg.exe	upx
C:\Windows\SysWOW64\selghfqh.exe	upx
\Windows\SysWOW64\rejrqfgolwcvr.exe	upx
C:\Windows\SysWOW64\wetdigkeql.exe	upx
C:\Windows\SysWOW64\rejrqfgolwcvr.exe	upx
behavioral1/memory/1256-74-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1068-76-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/580-77-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\selghfqh.exe	upx
C:\Windows\SysWOW64\rejrqfgolwcvr.exe	upx
C:\Windows\SysWOW64\hlndbrvczekafpg.exe	upx
\Windows\SysWOW64\selghfqh.exe	upx
C:\Windows\SysWOW64\selghfqh.exe	upx
behavioral1/memory/1696-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1440-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Program Files\WaitUnblock.doc.exe	upx
behavioral1/memory/1256-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1068-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/580-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/900-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1696-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 5 IoCs

Processes:

989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exewetdigkeql.exe

pid	process
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1256	wetdigkeql.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

wetdigkeql.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	wetdigkeql.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hlndbrvczekafpg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hlndbrvczekafpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qqcncdgd = "wetdigkeql.exe"	hlndbrvczekafpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\dnckaadf = "hlndbrvczekafpg.exe"	hlndbrvczekafpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "rejrqfgolwcvr.exe"	hlndbrvczekafpg.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wetdigkeql.exeselghfqh.exeselghfqh.exe

description	ioc	process
File opened (read-only)	\??\y:	wetdigkeql.exe
File opened (read-only)	\??\j:	selghfqh.exe
File opened (read-only)	\??\l:	selghfqh.exe
File opened (read-only)	\??\i:	wetdigkeql.exe
File opened (read-only)	\??\s:	selghfqh.exe
File opened (read-only)	\??\i:	selghfqh.exe
File opened (read-only)	\??\g:	wetdigkeql.exe
File opened (read-only)	\??\t:	wetdigkeql.exe
File opened (read-only)	\??\q:	selghfqh.exe
File opened (read-only)	\??\u:	selghfqh.exe
File opened (read-only)	\??\r:	selghfqh.exe
File opened (read-only)	\??\u:	selghfqh.exe
File opened (read-only)	\??\w:	selghfqh.exe
File opened (read-only)	\??\h:	selghfqh.exe
File opened (read-only)	\??\q:	selghfqh.exe
File opened (read-only)	\??\o:	selghfqh.exe
File opened (read-only)	\??\s:	wetdigkeql.exe
File opened (read-only)	\??\m:	selghfqh.exe
File opened (read-only)	\??\p:	selghfqh.exe
File opened (read-only)	\??\s:	selghfqh.exe
File opened (read-only)	\??\f:	wetdigkeql.exe
File opened (read-only)	\??\k:	wetdigkeql.exe
File opened (read-only)	\??\k:	selghfqh.exe
File opened (read-only)	\??\r:	wetdigkeql.exe
File opened (read-only)	\??\a:	selghfqh.exe
File opened (read-only)	\??\f:	selghfqh.exe
File opened (read-only)	\??\n:	selghfqh.exe
File opened (read-only)	\??\o:	selghfqh.exe
File opened (read-only)	\??\v:	selghfqh.exe
File opened (read-only)	\??\n:	selghfqh.exe
File opened (read-only)	\??\e:	wetdigkeql.exe
File opened (read-only)	\??\h:	wetdigkeql.exe
File opened (read-only)	\??\p:	wetdigkeql.exe
File opened (read-only)	\??\x:	wetdigkeql.exe
File opened (read-only)	\??\n:	wetdigkeql.exe
File opened (read-only)	\??\v:	wetdigkeql.exe
File opened (read-only)	\??\z:	wetdigkeql.exe
File opened (read-only)	\??\a:	selghfqh.exe
File opened (read-only)	\??\b:	selghfqh.exe
File opened (read-only)	\??\f:	selghfqh.exe
File opened (read-only)	\??\t:	selghfqh.exe
File opened (read-only)	\??\l:	wetdigkeql.exe
File opened (read-only)	\??\w:	selghfqh.exe
File opened (read-only)	\??\k:	selghfqh.exe
File opened (read-only)	\??\v:	selghfqh.exe
File opened (read-only)	\??\b:	wetdigkeql.exe
File opened (read-only)	\??\t:	selghfqh.exe
File opened (read-only)	\??\p:	selghfqh.exe
File opened (read-only)	\??\x:	selghfqh.exe
File opened (read-only)	\??\z:	selghfqh.exe
File opened (read-only)	\??\x:	selghfqh.exe
File opened (read-only)	\??\q:	wetdigkeql.exe
File opened (read-only)	\??\b:	selghfqh.exe
File opened (read-only)	\??\e:	selghfqh.exe
File opened (read-only)	\??\l:	selghfqh.exe
File opened (read-only)	\??\h:	selghfqh.exe
File opened (read-only)	\??\y:	selghfqh.exe
File opened (read-only)	\??\e:	selghfqh.exe
File opened (read-only)	\??\j:	selghfqh.exe
File opened (read-only)	\??\a:	wetdigkeql.exe
File opened (read-only)	\??\j:	wetdigkeql.exe
File opened (read-only)	\??\w:	wetdigkeql.exe
File opened (read-only)	\??\g:	selghfqh.exe
File opened (read-only)	\??\m:	selghfqh.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

wetdigkeql.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	wetdigkeql.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	wetdigkeql.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1440-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1440-58-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1256-74-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1068-76-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/580-77-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1696-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1440-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1256-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1068-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/580-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/900-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1696-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exewetdigkeql.exe

description	ioc	process
File created	C:\Windows\SysWOW64\hlndbrvczekafpg.exe	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
File created	C:\Windows\SysWOW64\rejrqfgolwcvr.exe	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
File opened for modification	C:\Windows\SysWOW64\rejrqfgolwcvr.exe	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
File created	C:\Windows\SysWOW64\wetdigkeql.exe	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
File opened for modification	C:\Windows\SysWOW64\wetdigkeql.exe	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
File opened for modification	C:\Windows\SysWOW64\hlndbrvczekafpg.exe	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
File created	C:\Windows\SysWOW64\selghfqh.exe	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
File opened for modification	C:\Windows\SysWOW64\selghfqh.exe	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	wetdigkeql.exe

Drops file in Program Files directory 7 IoCs

Processes:

selghfqh.exeselghfqh.exe

description	ioc	process
File opened for modification	C:\Program Files\WaitUnblock.doc.exe	selghfqh.exe
File opened for modification	\??\c:\Program Files\WaitUnblock.doc.exe	selghfqh.exe
File opened for modification	C:\Program Files\WaitUnblock.nal	selghfqh.exe
File created	\??\c:\Program Files\WaitUnblock.doc.exe	selghfqh.exe
File opened for modification	\??\c:\Program Files\WaitUnblock.doc.exe	selghfqh.exe
File opened for modification	C:\Program Files\WaitUnblock.doc.exe	selghfqh.exe
File opened for modification	C:\Program Files\WaitUnblock.nal	selghfqh.exe

Drops file in Windows directory 5 IoCs

Processes:

WINWORD.EXE989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe

description	ioc	process
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXEwetdigkeql.exe989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	wetdigkeql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	wetdigkeql.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB1B12F47E2399E53BDBAD433EDD7CE"	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABDFAB8F963F1E2830B3A43819D3992B3FC02F143630338E1C8459908D4"	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	wetdigkeql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1656 WINWORD.EXE

pid	process
1656	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exewetdigkeql.exeselghfqh.exehlndbrvczekafpg.exerejrqfgolwcvr.exeselghfqh.exe

pid	process
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1256	wetdigkeql.exe
1256	wetdigkeql.exe
1256	wetdigkeql.exe
1256	wetdigkeql.exe
1256	wetdigkeql.exe
580	selghfqh.exe
580	selghfqh.exe
580	selghfqh.exe
580	selghfqh.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
1696	selghfqh.exe
1696	selghfqh.exe
1696	selghfqh.exe
1696	selghfqh.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exewetdigkeql.exeselghfqh.exehlndbrvczekafpg.exerejrqfgolwcvr.exeselghfqh.exe

pid	process
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1256	wetdigkeql.exe
1256	wetdigkeql.exe
1256	wetdigkeql.exe
580	selghfqh.exe
580	selghfqh.exe
580	selghfqh.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1696	selghfqh.exe
1696	selghfqh.exe
1696	selghfqh.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exewetdigkeql.exeselghfqh.exehlndbrvczekafpg.exerejrqfgolwcvr.exeselghfqh.exe

pid	process
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
1256	wetdigkeql.exe
1256	wetdigkeql.exe
1256	wetdigkeql.exe
580	selghfqh.exe
580	selghfqh.exe
580	selghfqh.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
1068	hlndbrvczekafpg.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
900	rejrqfgolwcvr.exe
1696	selghfqh.exe
1696	selghfqh.exe
1696	selghfqh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1656 WINWORD.EXE
1656 WINWORD.EXE

pid	process
1656	WINWORD.EXE
1656	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exewetdigkeql.exeWINWORD.EXE

description	pid	process	target process
PID 1440 wrote to memory of 1256	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	wetdigkeql.exe
PID 1440 wrote to memory of 1256	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	wetdigkeql.exe
PID 1440 wrote to memory of 1256	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	wetdigkeql.exe
PID 1440 wrote to memory of 1256	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	wetdigkeql.exe
PID 1440 wrote to memory of 1068	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	hlndbrvczekafpg.exe
PID 1440 wrote to memory of 1068	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	hlndbrvczekafpg.exe
PID 1440 wrote to memory of 1068	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	hlndbrvczekafpg.exe
PID 1440 wrote to memory of 1068	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	hlndbrvczekafpg.exe
PID 1440 wrote to memory of 580	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	selghfqh.exe
PID 1440 wrote to memory of 580	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	selghfqh.exe
PID 1440 wrote to memory of 580	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	selghfqh.exe
PID 1440 wrote to memory of 580	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	selghfqh.exe
PID 1440 wrote to memory of 900	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	rejrqfgolwcvr.exe
PID 1440 wrote to memory of 900	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	rejrqfgolwcvr.exe
PID 1440 wrote to memory of 900	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	rejrqfgolwcvr.exe
PID 1440 wrote to memory of 900	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	rejrqfgolwcvr.exe
PID 1256 wrote to memory of 1696	1256	wetdigkeql.exe	selghfqh.exe
PID 1256 wrote to memory of 1696	1256	wetdigkeql.exe	selghfqh.exe
PID 1256 wrote to memory of 1696	1256	wetdigkeql.exe	selghfqh.exe
PID 1256 wrote to memory of 1696	1256	wetdigkeql.exe	selghfqh.exe
PID 1440 wrote to memory of 1656	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	WINWORD.EXE
PID 1440 wrote to memory of 1656	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	WINWORD.EXE
PID 1440 wrote to memory of 1656	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	WINWORD.EXE
PID 1440 wrote to memory of 1656	1440	989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe	WINWORD.EXE
PID 1656 wrote to memory of 752	1656	WINWORD.EXE	splwow64.exe
PID 1656 wrote to memory of 752	1656	WINWORD.EXE	splwow64.exe
PID 1656 wrote to memory of 752	1656	WINWORD.EXE	splwow64.exe
PID 1656 wrote to memory of 752	1656	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe
"C:\Users\Admin\AppData\Local\Temp\989fc7c190cb7d71dfec1c867d83fda2b530bb4b82211a518e3947c2160c433d.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\SysWOW64\wetdigkeql.exe
wetdigkeql.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\selghfqh.exe
C:\Windows\system32\selghfqh.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1696

C:\Windows\SysWOW64\hlndbrvczekafpg.exe
hlndbrvczekafpg.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1068

C:\Windows\SysWOW64\selghfqh.exe
selghfqh.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:580

C:\Windows\SysWOW64\rejrqfgolwcvr.exe
rejrqfgolwcvr.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:900

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:752

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WaitUnblock.doc.exe
Filesize
255KB

MD5
323ed42dcc31e2887fc7686ba761390a

SHA1
721b5bc6ee68d7b37cbe19ac2d4d37b2da62125a

SHA256
ebe1946e76f562ca0c1beca111241202873a3af48f0160bdf7b3153a74d74f46

SHA512
f085d326a23e4d08b235b440bda3f6c71ccbd1fbbd0365f526c1eccea3bdab86b6dc50769328252085c149f60f423d32d8bd2540dfe7aa27a4ea89e9fd7cb589

Download Submit
C:\Windows\SysWOW64\hlndbrvczekafpg.exe
Filesize
255KB

MD5
13aa5f9a01ae411c2803052ff158b509

SHA1
ab0938f06a50c714ac74aa1900543db32b2e497d

SHA256
e759cb409c27d33e40f4ad073c33e7bd5fc7ada5ed55235589c70c5065f32088

SHA512
33c7f0cbbd817d90100e60591377336e6af12f053356aff442e1b23f10b4d8ad053f969856d2f76446b4bcfad4323897bd1775dd1b88415879f7383753abf459

Download Submit
C:\Windows\SysWOW64\hlndbrvczekafpg.exe
Filesize
255KB

MD5
13aa5f9a01ae411c2803052ff158b509

SHA1
ab0938f06a50c714ac74aa1900543db32b2e497d

SHA256
e759cb409c27d33e40f4ad073c33e7bd5fc7ada5ed55235589c70c5065f32088

SHA512
33c7f0cbbd817d90100e60591377336e6af12f053356aff442e1b23f10b4d8ad053f969856d2f76446b4bcfad4323897bd1775dd1b88415879f7383753abf459

Download Submit
C:\Windows\SysWOW64\rejrqfgolwcvr.exe
Filesize
255KB

MD5
286b61d77ff1345a52db1b69df9197b5

SHA1
1b7c3022073ef69be7ea6635133005ead413df4e

SHA256
d8acdcc157903674351484defbb1e2982ab5ff78025e5d735c236b73fec3975e

SHA512
689e915cb6464cbe8bd5448ffee70d212fb92db2ebd1a886ba9c8c663d6d79bee41dc3cb7e730061018a1db67860cf02aae60f8474e122c3c7a1dd025ecda5eb

Download Submit
C:\Windows\SysWOW64\rejrqfgolwcvr.exe
Filesize
255KB

MD5
286b61d77ff1345a52db1b69df9197b5

SHA1
1b7c3022073ef69be7ea6635133005ead413df4e

SHA256
d8acdcc157903674351484defbb1e2982ab5ff78025e5d735c236b73fec3975e

SHA512
689e915cb6464cbe8bd5448ffee70d212fb92db2ebd1a886ba9c8c663d6d79bee41dc3cb7e730061018a1db67860cf02aae60f8474e122c3c7a1dd025ecda5eb

Download Submit
C:\Windows\SysWOW64\selghfqh.exe
Filesize
255KB

MD5
6aee31d00cc12a21a046dc048c8119e3

SHA1
610483d19c1cc3d764a6fb8d07d79bdcfa6edd16

SHA256
217a5418312824d2bea715c86661257d95e2cd588f11c1617234607418e49554

SHA512
2729ab3e4dd1645cea1bbd7f89d3c6c60f03232628571d3907d9055d5e397d1d9ed1342f64cee7d6934445a80f3b1dfc83518051da824a3060f8b64ad2afbdda

Download Submit
C:\Windows\SysWOW64\selghfqh.exe
Filesize
255KB

MD5
6aee31d00cc12a21a046dc048c8119e3

SHA1
610483d19c1cc3d764a6fb8d07d79bdcfa6edd16

SHA256
217a5418312824d2bea715c86661257d95e2cd588f11c1617234607418e49554

SHA512
2729ab3e4dd1645cea1bbd7f89d3c6c60f03232628571d3907d9055d5e397d1d9ed1342f64cee7d6934445a80f3b1dfc83518051da824a3060f8b64ad2afbdda

Download Submit
C:\Windows\SysWOW64\selghfqh.exe
Filesize
255KB

MD5
6aee31d00cc12a21a046dc048c8119e3

SHA1
610483d19c1cc3d764a6fb8d07d79bdcfa6edd16

SHA256
217a5418312824d2bea715c86661257d95e2cd588f11c1617234607418e49554

SHA512
2729ab3e4dd1645cea1bbd7f89d3c6c60f03232628571d3907d9055d5e397d1d9ed1342f64cee7d6934445a80f3b1dfc83518051da824a3060f8b64ad2afbdda

Download Submit
C:\Windows\SysWOW64\wetdigkeql.exe
Filesize
255KB

MD5
236b2e07f553207dccbeeb5d77b0f038

SHA1
2b69a7b1509498af3459829f0776f732ef73df79

SHA256
88b54447fc29cd33c276286be19efa2cd9219427cefa6bd0b4e4c71c6e611625

SHA512
6616e520bbdef4353b5cde35356713d83a402e60b96b25a0d23a9b2e4d72bf130c1406a1acabaf913ff56f1cbc89c8eaadd82338fd1ccbee0bb288bf004ea257

Download Submit
C:\Windows\SysWOW64\wetdigkeql.exe
Filesize
255KB

MD5
236b2e07f553207dccbeeb5d77b0f038

SHA1
2b69a7b1509498af3459829f0776f732ef73df79

SHA256
88b54447fc29cd33c276286be19efa2cd9219427cefa6bd0b4e4c71c6e611625

SHA512
6616e520bbdef4353b5cde35356713d83a402e60b96b25a0d23a9b2e4d72bf130c1406a1acabaf913ff56f1cbc89c8eaadd82338fd1ccbee0bb288bf004ea257

Download Submit
C:\Windows\mydoc.rtf
Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\hlndbrvczekafpg.exe
Filesize
255KB

MD5
13aa5f9a01ae411c2803052ff158b509

SHA1
ab0938f06a50c714ac74aa1900543db32b2e497d

SHA256
e759cb409c27d33e40f4ad073c33e7bd5fc7ada5ed55235589c70c5065f32088

SHA512
33c7f0cbbd817d90100e60591377336e6af12f053356aff442e1b23f10b4d8ad053f969856d2f76446b4bcfad4323897bd1775dd1b88415879f7383753abf459

Download Submit
\Windows\SysWOW64\rejrqfgolwcvr.exe
Filesize
255KB

MD5
286b61d77ff1345a52db1b69df9197b5

SHA1
1b7c3022073ef69be7ea6635133005ead413df4e

SHA256
d8acdcc157903674351484defbb1e2982ab5ff78025e5d735c236b73fec3975e

SHA512
689e915cb6464cbe8bd5448ffee70d212fb92db2ebd1a886ba9c8c663d6d79bee41dc3cb7e730061018a1db67860cf02aae60f8474e122c3c7a1dd025ecda5eb

Download Submit
\Windows\SysWOW64\selghfqh.exe
Filesize
255KB

MD5
6aee31d00cc12a21a046dc048c8119e3

SHA1
610483d19c1cc3d764a6fb8d07d79bdcfa6edd16

SHA256
217a5418312824d2bea715c86661257d95e2cd588f11c1617234607418e49554

SHA512
2729ab3e4dd1645cea1bbd7f89d3c6c60f03232628571d3907d9055d5e397d1d9ed1342f64cee7d6934445a80f3b1dfc83518051da824a3060f8b64ad2afbdda

Download Submit
\Windows\SysWOW64\selghfqh.exe
Filesize
255KB

MD5
6aee31d00cc12a21a046dc048c8119e3

SHA1
610483d19c1cc3d764a6fb8d07d79bdcfa6edd16

SHA256
217a5418312824d2bea715c86661257d95e2cd588f11c1617234607418e49554

SHA512
2729ab3e4dd1645cea1bbd7f89d3c6c60f03232628571d3907d9055d5e397d1d9ed1342f64cee7d6934445a80f3b1dfc83518051da824a3060f8b64ad2afbdda

Download Submit
\Windows\SysWOW64\wetdigkeql.exe
Filesize
255KB

MD5
236b2e07f553207dccbeeb5d77b0f038

SHA1
2b69a7b1509498af3459829f0776f732ef73df79

SHA256
88b54447fc29cd33c276286be19efa2cd9219427cefa6bd0b4e4c71c6e611625

SHA512
6616e520bbdef4353b5cde35356713d83a402e60b96b25a0d23a9b2e4d72bf130c1406a1acabaf913ff56f1cbc89c8eaadd82338fd1ccbee0bb288bf004ea257

Download Submit
memory/580-77-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/580-66-0x0000000000000000-mapping.dmp

Download
memory/580-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/752-102-0x0000000000000000-mapping.dmp

Download
memory/900-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/900-72-0x0000000000000000-mapping.dmp

Download
memory/1068-76-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1068-63-0x0000000000000000-mapping.dmp

Download
memory/1068-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1256-74-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1256-59-0x0000000000000000-mapping.dmp

Download
memory/1256-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1440-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1440-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1440-75-0x00000000022D0000-0x0000000002370000-memory.dmp

Filesize
640KB

Download
memory/1440-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1440-58-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1440-57-0x00000000022D0000-0x0000000002370000-memory.dmp

Filesize
640KB

Download
memory/1656-91-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1656-94-0x0000000071A3D000-0x0000000071A48000-memory.dmp

Filesize
44KB

Download
memory/1656-87-0x0000000000000000-mapping.dmp

Download
memory/1656-90-0x0000000070A51000-0x0000000070A53000-memory.dmp

Filesize
8KB

Download
memory/1656-101-0x0000000071A3D000-0x0000000071A48000-memory.dmp

Filesize
44KB

Download
memory/1656-89-0x0000000072FD1000-0x0000000072FD4000-memory.dmp

Filesize
12KB

Download
memory/1696-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1696-83-0x0000000000000000-mapping.dmp

Download
memory/1696-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads