d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868

Analysis

max time kernel
151s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
Size

255KB
MD5

63b0999be19cd61fd1daeafb5f15dc56
SHA1

b2c25cdea66c3faa95b7b1f29da466c2f70ea715
SHA256

d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868
SHA512

69a809f0f47574e5e228e18557ac8043f94bc0f0c9a1e1d119e6a5f5fbdd41d71e3ea2a2b29823e493a25853300568f42cede2198fbcc4f896bd58ba58ddce6d
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJx:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI+

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	unkymrhmhr.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	unkymrhmhr.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	unkymrhmhr.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	unkymrhmhr.exe

Executes dropped EXE 6 IoCs

pid	Process
1108	unkymrhmhr.exe
892	tgbgxjmfuvomdfg.exe
1972	vatxdoib.exe
1112	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
424	vatxdoib.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000005c51-55.dat	upx
behavioral1/files/0x0008000000005c51-57.dat	upx
behavioral1/files/0x0009000000013482-58.dat	upx
behavioral1/files/0x0009000000013482-61.dat	upx
behavioral1/files/0x0008000000005c51-63.dat	upx
behavioral1/files/0x0008000000013a09-64.dat	upx
behavioral1/files/0x0007000000013a31-69.dat	upx
behavioral1/files/0x0008000000013a09-66.dat	upx
behavioral1/files/0x0009000000013482-68.dat	upx
behavioral1/files/0x0007000000013a31-71.dat	upx
behavioral1/files/0x0008000000013a09-73.dat	upx
behavioral1/files/0x0007000000013a31-75.dat	upx
behavioral1/files/0x0007000000013a31-78.dat	upx
behavioral1/files/0x0007000000013a31-76.dat	upx
behavioral1/files/0x0008000000013a09-80.dat	upx
behavioral1/files/0x0008000000013a09-82.dat	upx
behavioral1/memory/1324-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1108-86-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1972-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/892-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1112-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1372-90-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/424-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1324-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00060000000142d7-100.dat	upx
behavioral1/files/0x0006000000014930-101.dat	upx
behavioral1/files/0x0006000000014ab1-102.dat	upx
behavioral1/memory/1108-103-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1972-105-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/892-104-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1112-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1372-107-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/424-108-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/424-112-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1972-113-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1764	cmd.exe
1108	unkymrhmhr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	unkymrhmhr.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gavpdzeu = "unkymrhmhr.exe"	tgbgxjmfuvomdfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kfkhuhwf = "tgbgxjmfuvomdfg.exe"	tgbgxjmfuvomdfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jlgkaqtjytamy.exe"	tgbgxjmfuvomdfg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	tgbgxjmfuvomdfg.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	vatxdoib.exe
File opened (read-only)	\??\i:	vatxdoib.exe
File opened (read-only)	\??\p:	vatxdoib.exe
File opened (read-only)	\??\x:	vatxdoib.exe
File opened (read-only)	\??\m:	vatxdoib.exe
File opened (read-only)	\??\q:	vatxdoib.exe
File opened (read-only)	\??\r:	vatxdoib.exe
File opened (read-only)	\??\a:	vatxdoib.exe
File opened (read-only)	\??\e:	vatxdoib.exe
File opened (read-only)	\??\u:	vatxdoib.exe
File opened (read-only)	\??\x:	vatxdoib.exe
File opened (read-only)	\??\o:	vatxdoib.exe
File opened (read-only)	\??\w:	vatxdoib.exe
File opened (read-only)	\??\l:	unkymrhmhr.exe
File opened (read-only)	\??\e:	vatxdoib.exe
File opened (read-only)	\??\p:	unkymrhmhr.exe
File opened (read-only)	\??\t:	vatxdoib.exe
File opened (read-only)	\??\n:	unkymrhmhr.exe
File opened (read-only)	\??\j:	vatxdoib.exe
File opened (read-only)	\??\v:	vatxdoib.exe
File opened (read-only)	\??\t:	vatxdoib.exe
File opened (read-only)	\??\g:	vatxdoib.exe
File opened (read-only)	\??\i:	unkymrhmhr.exe
File opened (read-only)	\??\w:	unkymrhmhr.exe
File opened (read-only)	\??\l:	vatxdoib.exe
File opened (read-only)	\??\r:	unkymrhmhr.exe
File opened (read-only)	\??\x:	unkymrhmhr.exe
File opened (read-only)	\??\f:	vatxdoib.exe
File opened (read-only)	\??\u:	vatxdoib.exe
File opened (read-only)	\??\l:	vatxdoib.exe
File opened (read-only)	\??\r:	vatxdoib.exe
File opened (read-only)	\??\v:	vatxdoib.exe
File opened (read-only)	\??\f:	unkymrhmhr.exe
File opened (read-only)	\??\y:	vatxdoib.exe
File opened (read-only)	\??\k:	vatxdoib.exe
File opened (read-only)	\??\v:	unkymrhmhr.exe
File opened (read-only)	\??\z:	unkymrhmhr.exe
File opened (read-only)	\??\k:	unkymrhmhr.exe
File opened (read-only)	\??\g:	vatxdoib.exe
File opened (read-only)	\??\o:	vatxdoib.exe
File opened (read-only)	\??\s:	vatxdoib.exe
File opened (read-only)	\??\m:	vatxdoib.exe
File opened (read-only)	\??\y:	vatxdoib.exe
File opened (read-only)	\??\e:	unkymrhmhr.exe
File opened (read-only)	\??\j:	unkymrhmhr.exe
File opened (read-only)	\??\s:	vatxdoib.exe
File opened (read-only)	\??\g:	unkymrhmhr.exe
File opened (read-only)	\??\q:	unkymrhmhr.exe
File opened (read-only)	\??\h:	unkymrhmhr.exe
File opened (read-only)	\??\n:	vatxdoib.exe
File opened (read-only)	\??\p:	vatxdoib.exe
File opened (read-only)	\??\z:	vatxdoib.exe
File opened (read-only)	\??\b:	vatxdoib.exe
File opened (read-only)	\??\w:	vatxdoib.exe
File opened (read-only)	\??\f:	vatxdoib.exe
File opened (read-only)	\??\z:	vatxdoib.exe
File opened (read-only)	\??\o:	unkymrhmhr.exe
File opened (read-only)	\??\i:	vatxdoib.exe
File opened (read-only)	\??\m:	unkymrhmhr.exe
File opened (read-only)	\??\s:	unkymrhmhr.exe
File opened (read-only)	\??\t:	unkymrhmhr.exe
File opened (read-only)	\??\u:	unkymrhmhr.exe
File opened (read-only)	\??\j:	vatxdoib.exe
File opened (read-only)	\??\q:	vatxdoib.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	unkymrhmhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	unkymrhmhr.exe

AutoIT Executable 16 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1324-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1108-86-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1972-88-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/892-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1112-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1372-90-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/424-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1324-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1108-103-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1972-105-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/892-104-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1112-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1372-107-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/424-108-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/424-112-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1972-113-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\unkymrhmhr.exe	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
File created	C:\Windows\SysWOW64\tgbgxjmfuvomdfg.exe	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
File created	C:\Windows\SysWOW64\vatxdoib.exe	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
File opened for modification	C:\Windows\SysWOW64\vatxdoib.exe	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
File opened for modification	C:\Windows\SysWOW64\jlgkaqtjytamy.exe	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
File created	C:\Windows\SysWOW64\unkymrhmhr.exe	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
File created	C:\Windows\SysWOW64\jlgkaqtjytamy.exe	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	unkymrhmhr.exe
File opened for modification	C:\Windows\SysWOW64\tgbgxjmfuvomdfg.exe	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe

Drops file in Program Files directory 22 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\SubmitExpand.doc.exe	vatxdoib.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vatxdoib.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	vatxdoib.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vatxdoib.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vatxdoib.exe
File created	\??\c:\Program Files\SubmitExpand.doc.exe	vatxdoib.exe
File created	\??\c:\Program Files\SubmitExpand.doc.exe	vatxdoib.exe
File opened for modification	C:\Program Files\SubmitExpand.doc.exe	vatxdoib.exe
File opened for modification	C:\Program Files\SubmitExpand.nal	vatxdoib.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	vatxdoib.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vatxdoib.exe
File opened for modification	\??\c:\Program Files\SubmitExpand.doc.exe	vatxdoib.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vatxdoib.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vatxdoib.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vatxdoib.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	vatxdoib.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vatxdoib.exe
File opened for modification	C:\Program Files\SubmitExpand.nal	vatxdoib.exe
File opened for modification	C:\Program Files\SubmitExpand.doc.exe	vatxdoib.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vatxdoib.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vatxdoib.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	vatxdoib.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	unkymrhmhr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	unkymrhmhr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	unkymrhmhr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	unkymrhmhr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B12B449538EA53CABADD329CD7C4"	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
816	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1108	unkymrhmhr.exe
1108	unkymrhmhr.exe
1108	unkymrhmhr.exe
1108	unkymrhmhr.exe
1108	unkymrhmhr.exe
892	tgbgxjmfuvomdfg.exe
892	tgbgxjmfuvomdfg.exe
892	tgbgxjmfuvomdfg.exe
892	tgbgxjmfuvomdfg.exe
892	tgbgxjmfuvomdfg.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1972	vatxdoib.exe
1972	vatxdoib.exe
1972	vatxdoib.exe
1972	vatxdoib.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
424	vatxdoib.exe
424	vatxdoib.exe
424	vatxdoib.exe
424	vatxdoib.exe
892	tgbgxjmfuvomdfg.exe
892	tgbgxjmfuvomdfg.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
892	tgbgxjmfuvomdfg.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
892	tgbgxjmfuvomdfg.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
892	tgbgxjmfuvomdfg.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
892	tgbgxjmfuvomdfg.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1108	unkymrhmhr.exe
1108	unkymrhmhr.exe
1108	unkymrhmhr.exe
892	tgbgxjmfuvomdfg.exe
892	tgbgxjmfuvomdfg.exe
892	tgbgxjmfuvomdfg.exe
1972	vatxdoib.exe
1972	vatxdoib.exe
1972	vatxdoib.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
424	vatxdoib.exe
424	vatxdoib.exe
424	vatxdoib.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
1108	unkymrhmhr.exe
1108	unkymrhmhr.exe
1108	unkymrhmhr.exe
892	tgbgxjmfuvomdfg.exe
892	tgbgxjmfuvomdfg.exe
892	tgbgxjmfuvomdfg.exe
1972	vatxdoib.exe
1972	vatxdoib.exe
1972	vatxdoib.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1112	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
1372	jlgkaqtjytamy.exe
424	vatxdoib.exe
424	vatxdoib.exe
424	vatxdoib.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
816	WINWORD.EXE
816	WINWORD.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1108	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	27
PID 1324 wrote to memory of 1108	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	27
PID 1324 wrote to memory of 1108	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	27
PID 1324 wrote to memory of 1108	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	27
PID 1324 wrote to memory of 892	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	28
PID 1324 wrote to memory of 892	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	28
PID 1324 wrote to memory of 892	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	28
PID 1324 wrote to memory of 892	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	28
PID 1324 wrote to memory of 1972	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	29
PID 1324 wrote to memory of 1972	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	29
PID 1324 wrote to memory of 1972	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	29
PID 1324 wrote to memory of 1972	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	29
PID 1324 wrote to memory of 1112	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	30
PID 1324 wrote to memory of 1112	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	30
PID 1324 wrote to memory of 1112	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	30
PID 1324 wrote to memory of 1112	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	30
PID 892 wrote to memory of 1764	892	tgbgxjmfuvomdfg.exe	31
PID 892 wrote to memory of 1764	892	tgbgxjmfuvomdfg.exe	31
PID 892 wrote to memory of 1764	892	tgbgxjmfuvomdfg.exe	31
PID 892 wrote to memory of 1764	892	tgbgxjmfuvomdfg.exe	31
PID 1764 wrote to memory of 1372	1764	cmd.exe	33
PID 1764 wrote to memory of 1372	1764	cmd.exe	33
PID 1764 wrote to memory of 1372	1764	cmd.exe	33
PID 1764 wrote to memory of 1372	1764	cmd.exe	33
PID 1108 wrote to memory of 424	1108	unkymrhmhr.exe	34
PID 1108 wrote to memory of 424	1108	unkymrhmhr.exe	34
PID 1108 wrote to memory of 424	1108	unkymrhmhr.exe	34
PID 1108 wrote to memory of 424	1108	unkymrhmhr.exe	34
PID 1324 wrote to memory of 816	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	35
PID 1324 wrote to memory of 816	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	35
PID 1324 wrote to memory of 816	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	35
PID 1324 wrote to memory of 816	1324	d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe	35
PID 816 wrote to memory of 2020	816	WINWORD.EXE	39
PID 816 wrote to memory of 2020	816	WINWORD.EXE	39
PID 816 wrote to memory of 2020	816	WINWORD.EXE	39
PID 816 wrote to memory of 2020	816	WINWORD.EXE	39

C:\Users\Admin\AppData\Local\Temp\d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe
"C:\Users\Admin\AppData\Local\Temp\d30c1b57978067dce840e020baf994d5944f9917a050253fd5150bd7be9c0868.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\unkymrhmhr.exe
  unkymrhmhr.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\SysWOW64\vatxdoib.exe
    C:\Windows\system32\vatxdoib.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:424
- C:\Windows\SysWOW64\tgbgxjmfuvomdfg.exe
  tgbgxjmfuvomdfg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c jlgkaqtjytamy.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\SysWOW64\jlgkaqtjytamy.exe
      jlgkaqtjytamy.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1372
- C:\Windows\SysWOW64\vatxdoib.exe
  vatxdoib.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1972
- C:\Windows\SysWOW64\jlgkaqtjytamy.exe
  jlgkaqtjytamy.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1112
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
c1244f61274fcf7648fae179f8235fba

SHA1
65a063f1f9628e571c5a0512a0e0c79ce8193f11

SHA256
77593eaaaff7d238ae7f917e93977dfc4d0c707be9643eb8ab8d9154f73b94c2

SHA512
80457a7c7788270a6fe2501595cf94119f6fbb861343bfc62e64ea2731fea1ffbae9c85f7c402293984bce7a22a408fecc25c9915a43c1bc061355df48a9f189

Download Submit
C:\Users\Admin\Documents\PublishGet.doc.exe

Filesize
255KB

MD5
7e47734173326cd4e6e135ffcd755124

SHA1
49f0a74f99e524a6beda1395dc1da0672e28ad92

SHA256
45427ccabe5279c1ea86e6061f72aac36c80ddaa2aa303d9e466e0a0477944ec

SHA512
c9f5099841b7101087b0bb77207f054f97575666ebb77acebfd6b9097ed42dc426df3853eb287d22f55653d6120210c5b3beb7a705ea7eeddce9418bf7db4f74

Download Submit
C:\Windows\SysWOW64\jlgkaqtjytamy.exe

Filesize
255KB

MD5
1e6b66d5ea46e1b5151c24721653f1cd

SHA1
c389c3401ed1d5360ef5d1414009898ea4cf8edd

SHA256
fb1598eb98248b25fd9f4872d62cb7443b6512891104bc9a691b8ada63a0b5c6

SHA512
7de05c07f3c54e700f2a2244a245ca9d8212cfda1fb5f3d820ee0dee48599c5bb5227b52f2e8dd377f8842880d6388c6c61d9abf27117932af85a230c1ffa21a

Download Submit
C:\Windows\SysWOW64\jlgkaqtjytamy.exe

Filesize
255KB

MD5
1e6b66d5ea46e1b5151c24721653f1cd

SHA1
c389c3401ed1d5360ef5d1414009898ea4cf8edd

SHA256
fb1598eb98248b25fd9f4872d62cb7443b6512891104bc9a691b8ada63a0b5c6

SHA512
7de05c07f3c54e700f2a2244a245ca9d8212cfda1fb5f3d820ee0dee48599c5bb5227b52f2e8dd377f8842880d6388c6c61d9abf27117932af85a230c1ffa21a

Download Submit
C:\Windows\SysWOW64\jlgkaqtjytamy.exe

Filesize
255KB

MD5
1e6b66d5ea46e1b5151c24721653f1cd

SHA1
c389c3401ed1d5360ef5d1414009898ea4cf8edd

SHA256
fb1598eb98248b25fd9f4872d62cb7443b6512891104bc9a691b8ada63a0b5c6

SHA512
7de05c07f3c54e700f2a2244a245ca9d8212cfda1fb5f3d820ee0dee48599c5bb5227b52f2e8dd377f8842880d6388c6c61d9abf27117932af85a230c1ffa21a

Download Submit
C:\Windows\SysWOW64\tgbgxjmfuvomdfg.exe

Filesize
255KB

MD5
b78b496ae7bbd8d0aeac3e6d443b3fcc

SHA1
73603fee27cf240a3c5a0ecad1e1293f8175858c

SHA256
b962e7fd6ebf6eca52e31843c258113473673189d87c44df1ea47bbcb180f476

SHA512
254f5ab972c9b7d865e81f7ebc2eaf2acbeba4f135c305b782b6d713f94e2fbcbf081da2ab49428cfdc518f2c8d55faaad80ef32696c8f79123441004766102d

Download Submit
C:\Windows\SysWOW64\tgbgxjmfuvomdfg.exe

Filesize
255KB

MD5
b78b496ae7bbd8d0aeac3e6d443b3fcc

SHA1
73603fee27cf240a3c5a0ecad1e1293f8175858c

SHA256
b962e7fd6ebf6eca52e31843c258113473673189d87c44df1ea47bbcb180f476

SHA512
254f5ab972c9b7d865e81f7ebc2eaf2acbeba4f135c305b782b6d713f94e2fbcbf081da2ab49428cfdc518f2c8d55faaad80ef32696c8f79123441004766102d

Download Submit
C:\Windows\SysWOW64\unkymrhmhr.exe

Filesize
255KB

MD5
ade5953ad1a824d7b06ad58ed74cc87f

SHA1
4f158e0b6ee2ecd3806c18c31cd1ccd8e056464c

SHA256
f6a2d6647224a15fe6144222fca86e4fd857fa2548999555981cecff353c6170

SHA512
862e6d8624fd7273e0e400c15ec8b06bd668d4547a427401c5fdf9193cb71e38b19e0e050e174fde181cd1835f7872d5fa63fd004125184ba987f873b10099a5

Download Submit
C:\Windows\SysWOW64\unkymrhmhr.exe

Filesize
255KB

MD5
ade5953ad1a824d7b06ad58ed74cc87f

SHA1
4f158e0b6ee2ecd3806c18c31cd1ccd8e056464c

SHA256
f6a2d6647224a15fe6144222fca86e4fd857fa2548999555981cecff353c6170

SHA512
862e6d8624fd7273e0e400c15ec8b06bd668d4547a427401c5fdf9193cb71e38b19e0e050e174fde181cd1835f7872d5fa63fd004125184ba987f873b10099a5

Download Submit
C:\Windows\SysWOW64\vatxdoib.exe

Filesize
255KB

MD5
e8bd05a1bb0f9ce856ece28c6079d188

SHA1
abe6c39012bcefea801eac2fd2c8cff09ae1c565

SHA256
cf1ab151c1f3ac24be39d20e806be55e6f7ea2682a6d6ba2a53f4b8e8dc82fb7

SHA512
c416460f7b8da8d19603c13eaecda0b610c1ddc68fe18c01be972de0ae3430e7e1ac335fb6e25f26cbbf923ff1af1a7b487d66a849ca8b13f6ccdcacf92d6c16

Download Submit
C:\Windows\SysWOW64\vatxdoib.exe

Filesize
255KB

MD5
e8bd05a1bb0f9ce856ece28c6079d188

SHA1
abe6c39012bcefea801eac2fd2c8cff09ae1c565

SHA256
cf1ab151c1f3ac24be39d20e806be55e6f7ea2682a6d6ba2a53f4b8e8dc82fb7

SHA512
c416460f7b8da8d19603c13eaecda0b610c1ddc68fe18c01be972de0ae3430e7e1ac335fb6e25f26cbbf923ff1af1a7b487d66a849ca8b13f6ccdcacf92d6c16

Download Submit
C:\Windows\SysWOW64\vatxdoib.exe

Filesize
255KB

MD5
e8bd05a1bb0f9ce856ece28c6079d188

SHA1
abe6c39012bcefea801eac2fd2c8cff09ae1c565

SHA256
cf1ab151c1f3ac24be39d20e806be55e6f7ea2682a6d6ba2a53f4b8e8dc82fb7

SHA512
c416460f7b8da8d19603c13eaecda0b610c1ddc68fe18c01be972de0ae3430e7e1ac335fb6e25f26cbbf923ff1af1a7b487d66a849ca8b13f6ccdcacf92d6c16

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\??\c:\Program Files\SubmitExpand.doc.exe

Filesize
255KB

MD5
fed64f985cdfff25dec2302f18fde6c2

SHA1
aac1bd92c5a6be9e159a5e5ef6bea34e223ff149

SHA256
eca38ca42184414fb44e84f8d2194595b5de4f5a769ea12f4fcfc057956f0fd2

SHA512
dfda4785e245884cb3339e9270628bcc345d2c852a1084fd69098e670a27f83c404644c05e35f793a05b81635e5ba3d416e5557fd3a115a4df733d9249bd9978

Download Submit
\Windows\SysWOW64\jlgkaqtjytamy.exe

Filesize
255KB

MD5
1e6b66d5ea46e1b5151c24721653f1cd

SHA1
c389c3401ed1d5360ef5d1414009898ea4cf8edd

SHA256
fb1598eb98248b25fd9f4872d62cb7443b6512891104bc9a691b8ada63a0b5c6

SHA512
7de05c07f3c54e700f2a2244a245ca9d8212cfda1fb5f3d820ee0dee48599c5bb5227b52f2e8dd377f8842880d6388c6c61d9abf27117932af85a230c1ffa21a

Download Submit
\Windows\SysWOW64\jlgkaqtjytamy.exe

Filesize
255KB

MD5
1e6b66d5ea46e1b5151c24721653f1cd

SHA1
c389c3401ed1d5360ef5d1414009898ea4cf8edd

SHA256
fb1598eb98248b25fd9f4872d62cb7443b6512891104bc9a691b8ada63a0b5c6

SHA512
7de05c07f3c54e700f2a2244a245ca9d8212cfda1fb5f3d820ee0dee48599c5bb5227b52f2e8dd377f8842880d6388c6c61d9abf27117932af85a230c1ffa21a

Download Submit
\Windows\SysWOW64\tgbgxjmfuvomdfg.exe

Filesize
255KB

MD5
b78b496ae7bbd8d0aeac3e6d443b3fcc

SHA1
73603fee27cf240a3c5a0ecad1e1293f8175858c

SHA256
b962e7fd6ebf6eca52e31843c258113473673189d87c44df1ea47bbcb180f476

SHA512
254f5ab972c9b7d865e81f7ebc2eaf2acbeba4f135c305b782b6d713f94e2fbcbf081da2ab49428cfdc518f2c8d55faaad80ef32696c8f79123441004766102d

Download Submit
\Windows\SysWOW64\unkymrhmhr.exe

Filesize
255KB

MD5
ade5953ad1a824d7b06ad58ed74cc87f

SHA1
4f158e0b6ee2ecd3806c18c31cd1ccd8e056464c

SHA256
f6a2d6647224a15fe6144222fca86e4fd857fa2548999555981cecff353c6170

SHA512
862e6d8624fd7273e0e400c15ec8b06bd668d4547a427401c5fdf9193cb71e38b19e0e050e174fde181cd1835f7872d5fa63fd004125184ba987f873b10099a5

Download Submit
\Windows\SysWOW64\vatxdoib.exe

Filesize
255KB

MD5
e8bd05a1bb0f9ce856ece28c6079d188

SHA1
abe6c39012bcefea801eac2fd2c8cff09ae1c565

SHA256
cf1ab151c1f3ac24be39d20e806be55e6f7ea2682a6d6ba2a53f4b8e8dc82fb7

SHA512
c416460f7b8da8d19603c13eaecda0b610c1ddc68fe18c01be972de0ae3430e7e1ac335fb6e25f26cbbf923ff1af1a7b487d66a849ca8b13f6ccdcacf92d6c16

Download Submit
\Windows\SysWOW64\vatxdoib.exe

Filesize
255KB

MD5
e8bd05a1bb0f9ce856ece28c6079d188

SHA1
abe6c39012bcefea801eac2fd2c8cff09ae1c565

SHA256
cf1ab151c1f3ac24be39d20e806be55e6f7ea2682a6d6ba2a53f4b8e8dc82fb7

SHA512
c416460f7b8da8d19603c13eaecda0b610c1ddc68fe18c01be972de0ae3430e7e1ac335fb6e25f26cbbf923ff1af1a7b487d66a849ca8b13f6ccdcacf92d6c16

Download Submit
memory/424-108-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/424-112-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/424-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/816-94-0x0000000072AF1000-0x0000000072AF4000-memory.dmp

Filesize
12KB

Download
memory/816-98-0x000000007155D000-0x0000000071568000-memory.dmp

Filesize
44KB

Download
memory/816-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/816-95-0x0000000070571000-0x0000000070573000-memory.dmp

Filesize
8KB

Download
memory/816-109-0x000000007155D000-0x0000000071568000-memory.dmp

Filesize
44KB

Download
memory/816-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/816-115-0x000000007155D000-0x0000000071568000-memory.dmp

Filesize
44KB

Download
memory/892-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/892-104-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1108-103-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1108-86-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1112-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1112-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1324-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1324-85-0x00000000023A0000-0x0000000002440000-memory.dmp

Filesize
640KB

Download
memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1324-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1372-107-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1372-90-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1972-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1972-105-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1972-113-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2020-111-0x000007FEFC001000-0x000007FEFC003000-memory.dmp

Filesize
8KB

Download