772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314

Analysis

max time kernel
188s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
Size

255KB
MD5

460dfde69634b19dbeee443af0e0b939
SHA1

0a3c1231c6f1aeacf1360a69dbd0becc8e6c52ac
SHA256

772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314
SHA512

e4536c9ef0390694effe0798cd3c5d6e2149cdc3a6cd74848acd56b3b63dcb3bbfaeec9f227720e5080059b118a86b98d8c3d0f305e78c412866ad3fd77e2d78
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJB:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIa

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	mklhtqjxoi.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	mklhtqjxoi.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	mklhtqjxoi.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	mklhtqjxoi.exe

Executes dropped EXE 5 IoCs

pid	Process
1892	mklhtqjxoi.exe
1736	wccwqowlgntdtpz.exe
800	stnjnthh.exe
936	nyncsvmertzuy.exe
1516	stnjnthh.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/884-55-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00140000000054ab-56.dat	upx
behavioral1/files/0x00140000000054ab-58.dat	upx
behavioral1/files/0x00140000000054ab-60.dat	upx
behavioral1/files/0x000900000001311a-61.dat	upx
behavioral1/files/0x000900000001311a-63.dat	upx
behavioral1/files/0x00080000000131fd-64.dat	upx
behavioral1/files/0x00080000000131fd-67.dat	upx
behavioral1/files/0x00070000000133dd-69.dat	upx
behavioral1/files/0x00070000000133dd-71.dat	upx
behavioral1/files/0x00080000000131fd-73.dat	upx
behavioral1/files/0x000900000001311a-74.dat	upx
behavioral1/files/0x00070000000133dd-75.dat	upx
behavioral1/memory/1892-78-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00080000000131fd-81.dat	upx
behavioral1/memory/1736-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/800-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/936-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00080000000131fd-85.dat	upx
behavioral1/memory/1516-88-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/884-90-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/800-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1892-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1736-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/936-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1516-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0006000000014330-106.dat	upx
behavioral1/files/0x00060000000142e0-105.dat	upx
behavioral1/files/0x0006000000014371-107.dat	upx
behavioral1/files/0x0006000000014495-108.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
1892	mklhtqjxoi.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	mklhtqjxoi.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	wccwqowlgntdtpz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gcosbhgv = "mklhtqjxoi.exe"	wccwqowlgntdtpz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cmycssgb = "wccwqowlgntdtpz.exe"	wccwqowlgntdtpz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "nyncsvmertzuy.exe"	wccwqowlgntdtpz.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	stnjnthh.exe
File opened (read-only)	\??\a:	mklhtqjxoi.exe
File opened (read-only)	\??\l:	stnjnthh.exe
File opened (read-only)	\??\p:	stnjnthh.exe
File opened (read-only)	\??\o:	stnjnthh.exe
File opened (read-only)	\??\y:	stnjnthh.exe
File opened (read-only)	\??\b:	mklhtqjxoi.exe
File opened (read-only)	\??\s:	mklhtqjxoi.exe
File opened (read-only)	\??\u:	mklhtqjxoi.exe
File opened (read-only)	\??\w:	mklhtqjxoi.exe
File opened (read-only)	\??\m:	mklhtqjxoi.exe
File opened (read-only)	\??\v:	mklhtqjxoi.exe
File opened (read-only)	\??\i:	stnjnthh.exe
File opened (read-only)	\??\z:	stnjnthh.exe
File opened (read-only)	\??\m:	stnjnthh.exe
File opened (read-only)	\??\n:	stnjnthh.exe
File opened (read-only)	\??\r:	stnjnthh.exe
File opened (read-only)	\??\a:	stnjnthh.exe
File opened (read-only)	\??\j:	stnjnthh.exe
File opened (read-only)	\??\b:	stnjnthh.exe
File opened (read-only)	\??\a:	stnjnthh.exe
File opened (read-only)	\??\z:	stnjnthh.exe
File opened (read-only)	\??\o:	mklhtqjxoi.exe
File opened (read-only)	\??\g:	stnjnthh.exe
File opened (read-only)	\??\x:	stnjnthh.exe
File opened (read-only)	\??\i:	stnjnthh.exe
File opened (read-only)	\??\i:	mklhtqjxoi.exe
File opened (read-only)	\??\k:	stnjnthh.exe
File opened (read-only)	\??\o:	stnjnthh.exe
File opened (read-only)	\??\q:	stnjnthh.exe
File opened (read-only)	\??\f:	stnjnthh.exe
File opened (read-only)	\??\p:	stnjnthh.exe
File opened (read-only)	\??\t:	stnjnthh.exe
File opened (read-only)	\??\w:	stnjnthh.exe
File opened (read-only)	\??\w:	stnjnthh.exe
File opened (read-only)	\??\t:	stnjnthh.exe
File opened (read-only)	\??\v:	stnjnthh.exe
File opened (read-only)	\??\q:	stnjnthh.exe
File opened (read-only)	\??\x:	stnjnthh.exe
File opened (read-only)	\??\j:	mklhtqjxoi.exe
File opened (read-only)	\??\r:	mklhtqjxoi.exe
File opened (read-only)	\??\y:	mklhtqjxoi.exe
File opened (read-only)	\??\s:	stnjnthh.exe
File opened (read-only)	\??\g:	stnjnthh.exe
File opened (read-only)	\??\m:	stnjnthh.exe
File opened (read-only)	\??\y:	stnjnthh.exe
File opened (read-only)	\??\s:	stnjnthh.exe
File opened (read-only)	\??\q:	mklhtqjxoi.exe
File opened (read-only)	\??\r:	stnjnthh.exe
File opened (read-only)	\??\h:	mklhtqjxoi.exe
File opened (read-only)	\??\l:	mklhtqjxoi.exe
File opened (read-only)	\??\x:	mklhtqjxoi.exe
File opened (read-only)	\??\e:	stnjnthh.exe
File opened (read-only)	\??\n:	stnjnthh.exe
File opened (read-only)	\??\u:	stnjnthh.exe
File opened (read-only)	\??\e:	stnjnthh.exe
File opened (read-only)	\??\l:	stnjnthh.exe
File opened (read-only)	\??\k:	mklhtqjxoi.exe
File opened (read-only)	\??\n:	mklhtqjxoi.exe
File opened (read-only)	\??\t:	mklhtqjxoi.exe
File opened (read-only)	\??\h:	stnjnthh.exe
File opened (read-only)	\??\u:	stnjnthh.exe
File opened (read-only)	\??\v:	stnjnthh.exe
File opened (read-only)	\??\e:	mklhtqjxoi.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	mklhtqjxoi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	mklhtqjxoi.exe

AutoIT Executable 11 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/884-55-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1892-78-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1736-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/800-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/936-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/884-90-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/800-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1892-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1736-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/936-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1516-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mklhtqjxoi.exe	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
File opened for modification	C:\Windows\SysWOW64\mklhtqjxoi.exe	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
File opened for modification	C:\Windows\SysWOW64\wccwqowlgntdtpz.exe	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
File created	C:\Windows\SysWOW64\nyncsvmertzuy.exe	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	mklhtqjxoi.exe
File created	C:\Windows\SysWOW64\wccwqowlgntdtpz.exe	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
File created	C:\Windows\SysWOW64\stnjnthh.exe	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
File opened for modification	C:\Windows\SysWOW64\stnjnthh.exe	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
File opened for modification	C:\Windows\SysWOW64\nyncsvmertzuy.exe	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	stnjnthh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	stnjnthh.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	stnjnthh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	stnjnthh.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	stnjnthh.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	stnjnthh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	stnjnthh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	stnjnthh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	stnjnthh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	stnjnthh.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	stnjnthh.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	stnjnthh.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	stnjnthh.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	stnjnthh.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	mklhtqjxoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	mklhtqjxoi.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	mklhtqjxoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC9FACEF911F2E7840E3B37819C39E4B08802FA4213033DE2CA459909A0"	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	mklhtqjxoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	mklhtqjxoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1792	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
1892	mklhtqjxoi.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
1892	mklhtqjxoi.exe
1892	mklhtqjxoi.exe
1892	mklhtqjxoi.exe
1892	mklhtqjxoi.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
800	stnjnthh.exe
800	stnjnthh.exe
800	stnjnthh.exe
800	stnjnthh.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
1736	wccwqowlgntdtpz.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: 33	1884	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1884	AUDIODG.EXE
Token: SeShutdownPrivilege	892	explorer.exe
Token: 33	1884	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1884	AUDIODG.EXE
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
1892	mklhtqjxoi.exe
1892	mklhtqjxoi.exe
1892	mklhtqjxoi.exe
800	stnjnthh.exe
800	stnjnthh.exe
800	stnjnthh.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
1516	stnjnthh.exe
892	explorer.exe
892	explorer.exe
1516	stnjnthh.exe
1516	stnjnthh.exe
1516	stnjnthh.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
1892	mklhtqjxoi.exe
1892	mklhtqjxoi.exe
1892	mklhtqjxoi.exe
800	stnjnthh.exe
800	stnjnthh.exe
800	stnjnthh.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
1736	wccwqowlgntdtpz.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
936	nyncsvmertzuy.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
1516	stnjnthh.exe
1516	stnjnthh.exe
1516	stnjnthh.exe
1516	stnjnthh.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe
892	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1792	WINWORD.EXE
1792	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1892	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	27
PID 884 wrote to memory of 1892	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	27
PID 884 wrote to memory of 1892	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	27
PID 884 wrote to memory of 1892	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	27
PID 884 wrote to memory of 1736	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	28
PID 884 wrote to memory of 1736	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	28
PID 884 wrote to memory of 1736	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	28
PID 884 wrote to memory of 1736	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	28
PID 884 wrote to memory of 800	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	29
PID 884 wrote to memory of 800	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	29
PID 884 wrote to memory of 800	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	29
PID 884 wrote to memory of 800	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	29
PID 884 wrote to memory of 936	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	30
PID 884 wrote to memory of 936	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	30
PID 884 wrote to memory of 936	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	30
PID 884 wrote to memory of 936	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	30
PID 1892 wrote to memory of 1516	1892	mklhtqjxoi.exe	32
PID 1892 wrote to memory of 1516	1892	mklhtqjxoi.exe	32
PID 1892 wrote to memory of 1516	1892	mklhtqjxoi.exe	32
PID 1892 wrote to memory of 1516	1892	mklhtqjxoi.exe	32
PID 884 wrote to memory of 1792	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	33
PID 884 wrote to memory of 1792	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	33
PID 884 wrote to memory of 1792	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	33
PID 884 wrote to memory of 1792	884	772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe	33
PID 1792 wrote to memory of 740	1792	WINWORD.EXE	39
PID 1792 wrote to memory of 740	1792	WINWORD.EXE	39
PID 1792 wrote to memory of 740	1792	WINWORD.EXE	39
PID 1792 wrote to memory of 740	1792	WINWORD.EXE	39

C:\Users\Admin\AppData\Local\Temp\772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe
"C:\Users\Admin\AppData\Local\Temp\772ff9794d412f70f3600099c7e20fd438d7ffe8a737f5b3ecaec8a4db8d3314.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\mklhtqjxoi.exe
  mklhtqjxoi.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\stnjnthh.exe
    C:\Windows\system32\stnjnthh.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1516
- C:\Windows\SysWOW64\wccwqowlgntdtpz.exe
  wccwqowlgntdtpz.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1736
- C:\Windows\SysWOW64\stnjnthh.exe
  stnjnthh.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:800
- C:\Windows\SysWOW64\nyncsvmertzuy.exe
  nyncsvmertzuy.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:936
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:740

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:892

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x480
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
c06bc3d2a0758271b91c0390e9f686a1

SHA1
6b5944de44e56dc78ce2af7d1aded4b7ac0194af

SHA256
860305ed66ac20eee8255438ed4bc6f97d479512a1308710f8f2d4f193442f46

SHA512
d80acdff943fe035b17910f4dcba0fb43125a387a17732169412112396f6d38c5f45df52861a06baa01060ea302b310d943b43ccd2dbb11900d41d20093f163f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
adb2b312f799c6cb84929e343980c49a

SHA1
b6015ffbb428db8e588486337caeb22307d7e5ac

SHA256
2de2cd8374357c4a051c4775132fdcfa5969e9da64e1241a330dbcce167c23fe

SHA512
18926f097fa451e758fe2d6288aa2f8b8084e56d41d8cadc9bdca291d3166312db55930850009db67ca4ec4ba6818db93b4a5b1a92daeca75b1eb7976f1d16a9

Download Submit
C:\Users\Admin\Documents\OpenUninstall.doc.exe

Filesize
255KB

MD5
edcd3dfb256d2d6ec86972e217019921

SHA1
35a4194a22e19ecc79c9a182c97236567263264b

SHA256
4ea3ad487d131a86d8010c61d195bedde14b5f5194a5d94f5387961185eb7eed

SHA512
6b83f30536f3e4ec6e5cbd2423936c7abad20bf53cb1273577e98ed06fd0748e8d82e57f49c14cc58b249b453abf0f897c82db98a2c02830ff5a5b37abcee351

Download Submit
C:\Users\Admin\Documents\ReadMerge.doc.exe

Filesize
255KB

MD5
2d9263c209934769dc0e2afed91ac5f7

SHA1
b68f574acd639a8e705092477accf9f9a3470617

SHA256
018b3870487425645a4652f7087ea5152709cc279ccf3d0e8464fdecb037c607

SHA512
f2750a8a433cfc7cf4b4e0cfd85f37fc6a5c13542e8b7298ee677a666b7bbb2e198194eb9b1713b8c3aab843fad8b9dcb9f7b452f5ad440c0df8d0edae7c09b1

Download Submit
C:\Windows\SysWOW64\mklhtqjxoi.exe

Filesize
255KB

MD5
f0132dc8824da1ba6c33684056b97258

SHA1
de1c3b1ca0ff40675eaba5579621e124ebff3324

SHA256
95fcb87c6c72b16de1eb1778f93fea42fe2d7f686f1a6c0cdeb5c8833da3f476

SHA512
2de25ac7c96f9c642e16ff2216e72f8f5edf83cd8a101c57b3d96998494d62e4ce31ea064ffc13179e4b0850f5e86f4fa946d7ac509c7fe56910018bb1f963a7

Download Submit
C:\Windows\SysWOW64\mklhtqjxoi.exe

Filesize
255KB

MD5
f0132dc8824da1ba6c33684056b97258

SHA1
de1c3b1ca0ff40675eaba5579621e124ebff3324

SHA256
95fcb87c6c72b16de1eb1778f93fea42fe2d7f686f1a6c0cdeb5c8833da3f476

SHA512
2de25ac7c96f9c642e16ff2216e72f8f5edf83cd8a101c57b3d96998494d62e4ce31ea064ffc13179e4b0850f5e86f4fa946d7ac509c7fe56910018bb1f963a7

Download Submit
C:\Windows\SysWOW64\nyncsvmertzuy.exe

Filesize
255KB

MD5
b77ae8d3bf15e7cb4029e69ac62c7773

SHA1
17c0f4f08946db1be1781cbdee13dcf9106c8d8a

SHA256
b975aae269a71fb083d939057fd8bfc20f2d211092240f0426c9dd0482de92fe

SHA512
cd34a51f886e113616de3784b31ac077828cbbb1a2e68e04ad170aff2f9b3c575ee553376911db8904e5573f62a277b5518b10505a746f1fb900e1036c2d7e1b

Download Submit
C:\Windows\SysWOW64\nyncsvmertzuy.exe

Filesize
255KB

MD5
b77ae8d3bf15e7cb4029e69ac62c7773

SHA1
17c0f4f08946db1be1781cbdee13dcf9106c8d8a

SHA256
b975aae269a71fb083d939057fd8bfc20f2d211092240f0426c9dd0482de92fe

SHA512
cd34a51f886e113616de3784b31ac077828cbbb1a2e68e04ad170aff2f9b3c575ee553376911db8904e5573f62a277b5518b10505a746f1fb900e1036c2d7e1b

Download Submit
C:\Windows\SysWOW64\stnjnthh.exe

Filesize
255KB

MD5
10628e1628742dc9c4b959acc76fb1b5

SHA1
ee16c6b0630143ade393d0cc5320e9d89c0a85bb

SHA256
8f3313ee754ddee068facb9c8213de94eba135963023c74811ee8884072cc2f6

SHA512
321faea0125b930588bb2d74ef323ad09e5ff1743d7ab43a76d32bbe6a9665a158642866fe2389968aecfae93fc90134ce9b0a8362a92d571f4f0afb5b0c3769

Download Submit
C:\Windows\SysWOW64\stnjnthh.exe

Filesize
255KB

MD5
10628e1628742dc9c4b959acc76fb1b5

SHA1
ee16c6b0630143ade393d0cc5320e9d89c0a85bb

SHA256
8f3313ee754ddee068facb9c8213de94eba135963023c74811ee8884072cc2f6

SHA512
321faea0125b930588bb2d74ef323ad09e5ff1743d7ab43a76d32bbe6a9665a158642866fe2389968aecfae93fc90134ce9b0a8362a92d571f4f0afb5b0c3769

Download Submit
C:\Windows\SysWOW64\stnjnthh.exe

Filesize
255KB

MD5
10628e1628742dc9c4b959acc76fb1b5

SHA1
ee16c6b0630143ade393d0cc5320e9d89c0a85bb

SHA256
8f3313ee754ddee068facb9c8213de94eba135963023c74811ee8884072cc2f6

SHA512
321faea0125b930588bb2d74ef323ad09e5ff1743d7ab43a76d32bbe6a9665a158642866fe2389968aecfae93fc90134ce9b0a8362a92d571f4f0afb5b0c3769

Download Submit
C:\Windows\SysWOW64\wccwqowlgntdtpz.exe

Filesize
255KB

MD5
87644ce332104ea2ec0464ce0b93f729

SHA1
8100d78c94bb337a98a677bdd011fac333bf7af8

SHA256
8f67994bb6ab2f59d3f58b1b8ce697ac8ba7b905e270398a7591d4fbc90bf714

SHA512
c36f8ee7f821bb894010aa41b5316214d35e8d09f23d206fab0c2df50495de7ab8c7c909bb8e20c898d3df8e5b5e637b86c8f1055bd36025ddbedc352d0c806f

Download Submit
C:\Windows\SysWOW64\wccwqowlgntdtpz.exe

Filesize
255KB

MD5
87644ce332104ea2ec0464ce0b93f729

SHA1
8100d78c94bb337a98a677bdd011fac333bf7af8

SHA256
8f67994bb6ab2f59d3f58b1b8ce697ac8ba7b905e270398a7591d4fbc90bf714

SHA512
c36f8ee7f821bb894010aa41b5316214d35e8d09f23d206fab0c2df50495de7ab8c7c909bb8e20c898d3df8e5b5e637b86c8f1055bd36025ddbedc352d0c806f

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\mklhtqjxoi.exe

Filesize
255KB

MD5
f0132dc8824da1ba6c33684056b97258

SHA1
de1c3b1ca0ff40675eaba5579621e124ebff3324

SHA256
95fcb87c6c72b16de1eb1778f93fea42fe2d7f686f1a6c0cdeb5c8833da3f476

SHA512
2de25ac7c96f9c642e16ff2216e72f8f5edf83cd8a101c57b3d96998494d62e4ce31ea064ffc13179e4b0850f5e86f4fa946d7ac509c7fe56910018bb1f963a7

Download Submit
\Windows\SysWOW64\nyncsvmertzuy.exe

Filesize
255KB

MD5
b77ae8d3bf15e7cb4029e69ac62c7773

SHA1
17c0f4f08946db1be1781cbdee13dcf9106c8d8a

SHA256
b975aae269a71fb083d939057fd8bfc20f2d211092240f0426c9dd0482de92fe

SHA512
cd34a51f886e113616de3784b31ac077828cbbb1a2e68e04ad170aff2f9b3c575ee553376911db8904e5573f62a277b5518b10505a746f1fb900e1036c2d7e1b

Download Submit
\Windows\SysWOW64\stnjnthh.exe

Filesize
255KB

MD5
10628e1628742dc9c4b959acc76fb1b5

SHA1
ee16c6b0630143ade393d0cc5320e9d89c0a85bb

SHA256
8f3313ee754ddee068facb9c8213de94eba135963023c74811ee8884072cc2f6

SHA512
321faea0125b930588bb2d74ef323ad09e5ff1743d7ab43a76d32bbe6a9665a158642866fe2389968aecfae93fc90134ce9b0a8362a92d571f4f0afb5b0c3769

Download Submit
\Windows\SysWOW64\stnjnthh.exe

Filesize
255KB

MD5
10628e1628742dc9c4b959acc76fb1b5

SHA1
ee16c6b0630143ade393d0cc5320e9d89c0a85bb

SHA256
8f3313ee754ddee068facb9c8213de94eba135963023c74811ee8884072cc2f6

SHA512
321faea0125b930588bb2d74ef323ad09e5ff1743d7ab43a76d32bbe6a9665a158642866fe2389968aecfae93fc90134ce9b0a8362a92d571f4f0afb5b0c3769

Download Submit
\Windows\SysWOW64\wccwqowlgntdtpz.exe

Filesize
255KB

MD5
87644ce332104ea2ec0464ce0b93f729

SHA1
8100d78c94bb337a98a677bdd011fac333bf7af8

SHA256
8f67994bb6ab2f59d3f58b1b8ce697ac8ba7b905e270398a7591d4fbc90bf714

SHA512
c36f8ee7f821bb894010aa41b5316214d35e8d09f23d206fab0c2df50495de7ab8c7c909bb8e20c898d3df8e5b5e637b86c8f1055bd36025ddbedc352d0c806f

Download Submit
memory/800-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/800-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/884-84-0x0000000002EE0000-0x0000000002F80000-memory.dmp

Filesize
640KB

Download
memory/884-55-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/884-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/884-77-0x0000000002EE0000-0x0000000002F80000-memory.dmp

Filesize
640KB

Download
memory/884-79-0x0000000002EE0000-0x0000000002F80000-memory.dmp

Filesize
640KB

Download
memory/884-90-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/892-76-0x000007FEFB581000-0x000007FEFB583000-memory.dmp

Filesize
8KB

Download
memory/936-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/936-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1516-88-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1516-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1736-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1736-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1792-102-0x000000007117D000-0x0000000071188000-memory.dmp

Filesize
44KB

Download
memory/1792-100-0x000000007117D000-0x0000000071188000-memory.dmp

Filesize
44KB

Download
memory/1792-98-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1792-97-0x0000000070191000-0x0000000070193000-memory.dmp

Filesize
8KB

Download
memory/1792-91-0x0000000072711000-0x0000000072714000-memory.dmp

Filesize
12KB

Download
memory/1892-78-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1892-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download