f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c

Analysis

max time kernel
165s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
Size

255KB
MD5

959659d0dad9d478b5e9300adf841e94
SHA1

30821776c716ec7506f0d8951c5a782a601eef9d
SHA256

f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c
SHA512

603a1c6060882c44870e2122594ec510f31446679aae09c4158bad2a156b537473cf0fd7df3f66c0d21d9cddb2ecc9aee456f7381437c843ff4bcc46c23f8d87
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJe:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIR

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ilbbwqdcyp.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ilbbwqdcyp.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ilbbwqdcyp.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ilbbwqdcyp.exe

Executes dropped EXE 6 IoCs

pid	Process
1356	ilbbwqdcyp.exe
692	vfxjrhwjgfavfgi.exe
528	imlzbbbf.exe
1336	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1852	imlzbbbf.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b000000012302-55.dat	upx
behavioral1/files/0x000b000000012302-58.dat	upx
behavioral1/files/0x000a000000012308-57.dat	upx
behavioral1/files/0x000a000000012308-61.dat	upx
behavioral1/files/0x0008000000012318-71.dat	upx
behavioral1/memory/1356-69-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/972-63-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0008000000012318-64.dat	upx
behavioral1/files/0x000b000000012302-68.dat	upx
behavioral1/files/0x000a000000012308-67.dat	upx
behavioral1/memory/692-73-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x000800000001231b-77.dat	upx
behavioral1/files/0x000800000001231b-76.dat	upx
behavioral1/files/0x000800000001231b-81.dat	upx
behavioral1/files/0x000800000001231b-79.dat	upx
behavioral1/files/0x000800000001231b-74.dat	upx
behavioral1/files/0x0008000000012318-84.dat	upx
behavioral1/files/0x0008000000012318-83.dat	upx
behavioral1/files/0x0008000000012318-86.dat	upx
behavioral1/memory/972-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/528-91-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1336-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1948-93-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1852-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1356-100-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/692-101-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/528-102-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1336-103-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1948-104-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1852-105-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00070000000132fb-106.dat	upx
behavioral1/files/0x000700000001332a-107.dat	upx
behavioral1/files/0x00070000000133af-109.dat	upx
behavioral1/files/0x00070000000133af-110.dat	upx
behavioral1/files/0x00070000000133e5-111.dat	upx
behavioral1/memory/1852-115-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/528-116-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
1176	cmd.exe
1356	ilbbwqdcyp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ilbbwqdcyp.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vfxjrhwjgfavfgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ljorihgc = "ilbbwqdcyp.exe"	vfxjrhwjgfavfgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ufzfihob = "vfxjrhwjgfavfgi.exe"	vfxjrhwjgfavfgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "shwiqrkxgugig.exe"	vfxjrhwjgfavfgi.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	ilbbwqdcyp.exe
File opened (read-only)	\??\q:	imlzbbbf.exe
File opened (read-only)	\??\j:	ilbbwqdcyp.exe
File opened (read-only)	\??\y:	ilbbwqdcyp.exe
File opened (read-only)	\??\x:	imlzbbbf.exe
File opened (read-only)	\??\e:	imlzbbbf.exe
File opened (read-only)	\??\k:	imlzbbbf.exe
File opened (read-only)	\??\p:	imlzbbbf.exe
File opened (read-only)	\??\z:	imlzbbbf.exe
File opened (read-only)	\??\h:	ilbbwqdcyp.exe
File opened (read-only)	\??\x:	ilbbwqdcyp.exe
File opened (read-only)	\??\l:	imlzbbbf.exe
File opened (read-only)	\??\y:	imlzbbbf.exe
File opened (read-only)	\??\j:	imlzbbbf.exe
File opened (read-only)	\??\n:	ilbbwqdcyp.exe
File opened (read-only)	\??\o:	ilbbwqdcyp.exe
File opened (read-only)	\??\r:	ilbbwqdcyp.exe
File opened (read-only)	\??\u:	ilbbwqdcyp.exe
File opened (read-only)	\??\f:	imlzbbbf.exe
File opened (read-only)	\??\w:	ilbbwqdcyp.exe
File opened (read-only)	\??\h:	imlzbbbf.exe
File opened (read-only)	\??\k:	imlzbbbf.exe
File opened (read-only)	\??\t:	imlzbbbf.exe
File opened (read-only)	\??\o:	imlzbbbf.exe
File opened (read-only)	\??\u:	imlzbbbf.exe
File opened (read-only)	\??\v:	imlzbbbf.exe
File opened (read-only)	\??\x:	imlzbbbf.exe
File opened (read-only)	\??\l:	ilbbwqdcyp.exe
File opened (read-only)	\??\s:	ilbbwqdcyp.exe
File opened (read-only)	\??\i:	imlzbbbf.exe
File opened (read-only)	\??\m:	imlzbbbf.exe
File opened (read-only)	\??\m:	imlzbbbf.exe
File opened (read-only)	\??\k:	ilbbwqdcyp.exe
File opened (read-only)	\??\e:	imlzbbbf.exe
File opened (read-only)	\??\r:	imlzbbbf.exe
File opened (read-only)	\??\g:	imlzbbbf.exe
File opened (read-only)	\??\s:	imlzbbbf.exe
File opened (read-only)	\??\f:	ilbbwqdcyp.exe
File opened (read-only)	\??\q:	ilbbwqdcyp.exe
File opened (read-only)	\??\q:	imlzbbbf.exe
File opened (read-only)	\??\o:	imlzbbbf.exe
File opened (read-only)	\??\l:	imlzbbbf.exe
File opened (read-only)	\??\v:	imlzbbbf.exe
File opened (read-only)	\??\b:	ilbbwqdcyp.exe
File opened (read-only)	\??\e:	ilbbwqdcyp.exe
File opened (read-only)	\??\s:	imlzbbbf.exe
File opened (read-only)	\??\a:	imlzbbbf.exe
File opened (read-only)	\??\t:	ilbbwqdcyp.exe
File opened (read-only)	\??\n:	imlzbbbf.exe
File opened (read-only)	\??\y:	imlzbbbf.exe
File opened (read-only)	\??\v:	ilbbwqdcyp.exe
File opened (read-only)	\??\w:	imlzbbbf.exe
File opened (read-only)	\??\z:	imlzbbbf.exe
File opened (read-only)	\??\b:	imlzbbbf.exe
File opened (read-only)	\??\m:	ilbbwqdcyp.exe
File opened (read-only)	\??\p:	ilbbwqdcyp.exe
File opened (read-only)	\??\b:	imlzbbbf.exe
File opened (read-only)	\??\f:	imlzbbbf.exe
File opened (read-only)	\??\i:	ilbbwqdcyp.exe
File opened (read-only)	\??\h:	imlzbbbf.exe
File opened (read-only)	\??\n:	imlzbbbf.exe
File opened (read-only)	\??\g:	imlzbbbf.exe
File opened (read-only)	\??\p:	imlzbbbf.exe
File opened (read-only)	\??\w:	imlzbbbf.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	ilbbwqdcyp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	ilbbwqdcyp.exe

AutoIT Executable 16 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1356-69-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/972-63-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/692-73-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/972-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/528-91-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1336-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1948-93-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1852-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1356-100-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/692-101-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/528-102-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1336-103-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1948-104-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1852-105-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1852-115-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/528-116-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ilbbwqdcyp.exe	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
File opened for modification	C:\Windows\SysWOW64\vfxjrhwjgfavfgi.exe	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	ilbbwqdcyp.exe
File opened for modification	C:\Windows\SysWOW64\ilbbwqdcyp.exe	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
File created	C:\Windows\SysWOW64\vfxjrhwjgfavfgi.exe	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
File created	C:\Windows\SysWOW64\imlzbbbf.exe	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
File opened for modification	C:\Windows\SysWOW64\imlzbbbf.exe	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
File created	C:\Windows\SysWOW64\shwiqrkxgugig.exe	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
File opened for modification	C:\Windows\SysWOW64\shwiqrkxgugig.exe	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	imlzbbbf.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	imlzbbbf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	imlzbbbf.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	imlzbbbf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	imlzbbbf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	imlzbbbf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	imlzbbbf.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	imlzbbbf.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	imlzbbbf.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	imlzbbbf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	imlzbbbf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	imlzbbbf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	imlzbbbf.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	imlzbbbf.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	imlzbbbf.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33352C0F9C5283226D4477D170222CDD7C8765D9"	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	ilbbwqdcyp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	ilbbwqdcyp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	ilbbwqdcyp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	ilbbwqdcyp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCAFAC9FE65F193840B3B32819C39E2B088028B4369023FE1C842E708A3"	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1945C60C1491DAC4B8CD7C95ED9134CB"	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	ilbbwqdcyp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2032	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
692	vfxjrhwjgfavfgi.exe
692	vfxjrhwjgfavfgi.exe
692	vfxjrhwjgfavfgi.exe
692	vfxjrhwjgfavfgi.exe
692	vfxjrhwjgfavfgi.exe
1356	ilbbwqdcyp.exe
1356	ilbbwqdcyp.exe
1356	ilbbwqdcyp.exe
1356	ilbbwqdcyp.exe
1356	ilbbwqdcyp.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
692	vfxjrhwjgfavfgi.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
528	imlzbbbf.exe
528	imlzbbbf.exe
528	imlzbbbf.exe
528	imlzbbbf.exe
1852	imlzbbbf.exe
1852	imlzbbbf.exe
1852	imlzbbbf.exe
1852	imlzbbbf.exe
692	vfxjrhwjgfavfgi.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
692	vfxjrhwjgfavfgi.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
692	vfxjrhwjgfavfgi.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
692	vfxjrhwjgfavfgi.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
692	vfxjrhwjgfavfgi.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
692	vfxjrhwjgfavfgi.exe
1948	shwiqrkxgugig.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
692	vfxjrhwjgfavfgi.exe
692	vfxjrhwjgfavfgi.exe
692	vfxjrhwjgfavfgi.exe
1356	ilbbwqdcyp.exe
1356	ilbbwqdcyp.exe
1356	ilbbwqdcyp.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
528	imlzbbbf.exe
528	imlzbbbf.exe
528	imlzbbbf.exe
1852	imlzbbbf.exe
1852	imlzbbbf.exe
1852	imlzbbbf.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
692	vfxjrhwjgfavfgi.exe
692	vfxjrhwjgfavfgi.exe
692	vfxjrhwjgfavfgi.exe
1356	ilbbwqdcyp.exe
1356	ilbbwqdcyp.exe
1356	ilbbwqdcyp.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1336	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
1948	shwiqrkxgugig.exe
528	imlzbbbf.exe
528	imlzbbbf.exe
528	imlzbbbf.exe
1852	imlzbbbf.exe
1852	imlzbbbf.exe
1852	imlzbbbf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	WINWORD.EXE
2032	WINWORD.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1356	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	28
PID 972 wrote to memory of 1356	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	28
PID 972 wrote to memory of 1356	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	28
PID 972 wrote to memory of 1356	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	28
PID 972 wrote to memory of 692	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	29
PID 972 wrote to memory of 692	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	29
PID 972 wrote to memory of 692	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	29
PID 972 wrote to memory of 692	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	29
PID 972 wrote to memory of 528	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	32
PID 972 wrote to memory of 528	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	32
PID 972 wrote to memory of 528	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	32
PID 972 wrote to memory of 528	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	32
PID 692 wrote to memory of 1176	692	vfxjrhwjgfavfgi.exe	31
PID 692 wrote to memory of 1176	692	vfxjrhwjgfavfgi.exe	31
PID 692 wrote to memory of 1176	692	vfxjrhwjgfavfgi.exe	31
PID 692 wrote to memory of 1176	692	vfxjrhwjgfavfgi.exe	31
PID 972 wrote to memory of 1336	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	33
PID 972 wrote to memory of 1336	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	33
PID 972 wrote to memory of 1336	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	33
PID 972 wrote to memory of 1336	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	33
PID 1176 wrote to memory of 1948	1176	cmd.exe	34
PID 1176 wrote to memory of 1948	1176	cmd.exe	34
PID 1176 wrote to memory of 1948	1176	cmd.exe	34
PID 1176 wrote to memory of 1948	1176	cmd.exe	34
PID 1356 wrote to memory of 1852	1356	ilbbwqdcyp.exe	35
PID 1356 wrote to memory of 1852	1356	ilbbwqdcyp.exe	35
PID 1356 wrote to memory of 1852	1356	ilbbwqdcyp.exe	35
PID 1356 wrote to memory of 1852	1356	ilbbwqdcyp.exe	35
PID 972 wrote to memory of 2032	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	36
PID 972 wrote to memory of 2032	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	36
PID 972 wrote to memory of 2032	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	36
PID 972 wrote to memory of 2032	972	f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe	36
PID 2032 wrote to memory of 1048	2032	WINWORD.EXE	40
PID 2032 wrote to memory of 1048	2032	WINWORD.EXE	40
PID 2032 wrote to memory of 1048	2032	WINWORD.EXE	40
PID 2032 wrote to memory of 1048	2032	WINWORD.EXE	40

C:\Users\Admin\AppData\Local\Temp\f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe
"C:\Users\Admin\AppData\Local\Temp\f98c438be981cf04775be0aaede2491a97d7209323426e6e38dbfbcf067bf20c.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\ilbbwqdcyp.exe
  ilbbwqdcyp.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\imlzbbbf.exe
    C:\Windows\system32\imlzbbbf.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1852
- C:\Windows\SysWOW64\vfxjrhwjgfavfgi.exe
  vfxjrhwjgfavfgi.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c shwiqrkxgugig.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\shwiqrkxgugig.exe
      shwiqrkxgugig.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1948
- C:\Windows\SysWOW64\imlzbbbf.exe
  imlzbbbf.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:528
- C:\Windows\SysWOW64\shwiqrkxgugig.exe
  shwiqrkxgugig.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1336
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
6b263598731ea3046e2f445472325422

SHA1
540d529fdfaec0c59b7344c09718402c4ca0e1f4

SHA256
741b8de87c28bc8e178e81e95d4eea868246160b600d0b7ae753fb863dad8cb5

SHA512
a14f606199c935cdb262d66036cd416dd1b90750017d49aaff47a4550dd24abf0820d1c3fbca395a194b0a3daa66d0b999d1fc64b2bf57a1d39af0ea7ccb23a8

Download Submit
C:\Users\Admin\Documents\ConfirmInitialize.doc.exe

Filesize
255KB

MD5
3a689625c3faba1e70a04a44e7790444

SHA1
8619966a917a1ce9b23e0c169360ed00ae997b5f

SHA256
25da7abfa77d9bbbe34356e24968468b1f7489cc6060b073b50044c4dd201af7

SHA512
d217bf1b4546e9434527f87fd8209f97f3998cc5022f46765792ed025e97f15974b57670529c62de06e5c1783d516c4c4aa79ca6197c46078ec683ce5c5ccfaa

Download Submit
C:\Users\Admin\Downloads\RenameSplit.doc.exe

Filesize
255KB

MD5
69ee2de7c6e4a13873ca7f2b8c0e66c8

SHA1
df32406a74cd667af1658f48667993699944d829

SHA256
dbb60c001d61075b383743d18bd7aef95709e685aa5866b3c168b4011289399c

SHA512
60ebee752c56668eec59468757979b855ac8c5f8ef8ac10a7471f96a7e299eaeff5ac4a8190039de931ed664057a1088e7a9a6242505b4dccbd8108af05e69b6

Download Submit
C:\Windows\SysWOW64\ilbbwqdcyp.exe

Filesize
255KB

MD5
da5f057f5492d12c2b65f3ed33778deb

SHA1
c0a48055beeb427af18a34732d89868cc926a52b

SHA256
fbb2ed9813d44ca5b223b3d6f49aa1a6d505efa6ff77911ff7048db019ba2afb

SHA512
b021d9fcc7f718ac8270a8eb27a47e08fd0545ab79db1a93b4a9f92fc994abae1afa69a3d98f14535bb3be04d76a5ddcedac421e69fcf9e527719c198eea6846

Download Submit
C:\Windows\SysWOW64\ilbbwqdcyp.exe

Filesize
255KB

MD5
da5f057f5492d12c2b65f3ed33778deb

SHA1
c0a48055beeb427af18a34732d89868cc926a52b

SHA256
fbb2ed9813d44ca5b223b3d6f49aa1a6d505efa6ff77911ff7048db019ba2afb

SHA512
b021d9fcc7f718ac8270a8eb27a47e08fd0545ab79db1a93b4a9f92fc994abae1afa69a3d98f14535bb3be04d76a5ddcedac421e69fcf9e527719c198eea6846

Download Submit
C:\Windows\SysWOW64\imlzbbbf.exe

Filesize
255KB

MD5
aa4c4594b7af0ac797bd1e280b3498ba

SHA1
cb10cf363c4fcaeda07f8f060dda411b26b0fa55

SHA256
d92bdb037e2456d88343364fadceee02627219afe08cb95ea72246c9b1c22104

SHA512
15f4f8d9f541112422a65214e9342512ae2a7eaab3c3373d0200bf1f4e6c6faf31c18fd9d01cbf50a3500a626c1bf1a3702beba7802c6587ab1e665419a68cc1

Download Submit
C:\Windows\SysWOW64\imlzbbbf.exe

Filesize
255KB

MD5
aa4c4594b7af0ac797bd1e280b3498ba

SHA1
cb10cf363c4fcaeda07f8f060dda411b26b0fa55

SHA256
d92bdb037e2456d88343364fadceee02627219afe08cb95ea72246c9b1c22104

SHA512
15f4f8d9f541112422a65214e9342512ae2a7eaab3c3373d0200bf1f4e6c6faf31c18fd9d01cbf50a3500a626c1bf1a3702beba7802c6587ab1e665419a68cc1

Download Submit
C:\Windows\SysWOW64\imlzbbbf.exe

Filesize
255KB

MD5
aa4c4594b7af0ac797bd1e280b3498ba

SHA1
cb10cf363c4fcaeda07f8f060dda411b26b0fa55

SHA256
d92bdb037e2456d88343364fadceee02627219afe08cb95ea72246c9b1c22104

SHA512
15f4f8d9f541112422a65214e9342512ae2a7eaab3c3373d0200bf1f4e6c6faf31c18fd9d01cbf50a3500a626c1bf1a3702beba7802c6587ab1e665419a68cc1

Download Submit
C:\Windows\SysWOW64\shwiqrkxgugig.exe

Filesize
255KB

MD5
5c55640333ce7a17a827e823afcc541d

SHA1
e26e53f4095dedf07c8cb943573d3b88c90e5b91

SHA256
6c32a1a85aa6a43a5b3b26553ae15693842e5dbfe48bbaf91da83d0a4094dbce

SHA512
e9c8115898e34964b2c003e9878eea0f082234e35662e48f92e4eb91f88117e1e302dc2db47831d77895e42e75db34a23101a1ee8c2bc2dbe18f49d3b97e2f54

Download Submit
C:\Windows\SysWOW64\shwiqrkxgugig.exe

Filesize
255KB

MD5
5c55640333ce7a17a827e823afcc541d

SHA1
e26e53f4095dedf07c8cb943573d3b88c90e5b91

SHA256
6c32a1a85aa6a43a5b3b26553ae15693842e5dbfe48bbaf91da83d0a4094dbce

SHA512
e9c8115898e34964b2c003e9878eea0f082234e35662e48f92e4eb91f88117e1e302dc2db47831d77895e42e75db34a23101a1ee8c2bc2dbe18f49d3b97e2f54

Download Submit
C:\Windows\SysWOW64\shwiqrkxgugig.exe

Filesize
255KB

MD5
5c55640333ce7a17a827e823afcc541d

SHA1
e26e53f4095dedf07c8cb943573d3b88c90e5b91

SHA256
6c32a1a85aa6a43a5b3b26553ae15693842e5dbfe48bbaf91da83d0a4094dbce

SHA512
e9c8115898e34964b2c003e9878eea0f082234e35662e48f92e4eb91f88117e1e302dc2db47831d77895e42e75db34a23101a1ee8c2bc2dbe18f49d3b97e2f54

Download Submit
C:\Windows\SysWOW64\vfxjrhwjgfavfgi.exe

Filesize
255KB

MD5
160e00a4d2874e0d86a6be9b0b8906f9

SHA1
8aebc9c646f0156242f62cae333989ac389ace8e

SHA256
20e735db2fe74ef3bbc49393f39cbd79606d1be1ceea8207ab1403140da56efd

SHA512
a4504ba75589bb99e0ef06b1f68a1d0c5cbaabb9aa1d26a8fdae0c8659371bd937b458869749943f842e64c734ddf3be2aabedac333caea5b0e3a02385af6297

Download Submit
C:\Windows\SysWOW64\vfxjrhwjgfavfgi.exe

Filesize
255KB

MD5
160e00a4d2874e0d86a6be9b0b8906f9

SHA1
8aebc9c646f0156242f62cae333989ac389ace8e

SHA256
20e735db2fe74ef3bbc49393f39cbd79606d1be1ceea8207ab1403140da56efd

SHA512
a4504ba75589bb99e0ef06b1f68a1d0c5cbaabb9aa1d26a8fdae0c8659371bd937b458869749943f842e64c734ddf3be2aabedac333caea5b0e3a02385af6297

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
625db70a3a06c1696d0751b361045672

SHA1
599a1094c9822c60dbe39a58c608e1f2b421d81f

SHA256
f9f70a1118589e2f1cbb09b14c624f0eb3d8e6a6b618d57cc49f54bbca746cc7

SHA512
77fb656c46b003fc47b944d192618aa780432aad62cd5340f1765c3946818e160d64185981f13bc42808ee367da09326b6016aade0f7ed96e078a1168f3011a8

Download Submit
\??\c:\Users\Admin\Documents\ConfirmInitialize.doc.exe

Filesize
255KB

MD5
3a689625c3faba1e70a04a44e7790444

SHA1
8619966a917a1ce9b23e0c169360ed00ae997b5f

SHA256
25da7abfa77d9bbbe34356e24968468b1f7489cc6060b073b50044c4dd201af7

SHA512
d217bf1b4546e9434527f87fd8209f97f3998cc5022f46765792ed025e97f15974b57670529c62de06e5c1783d516c4c4aa79ca6197c46078ec683ce5c5ccfaa

Download Submit
\Windows\SysWOW64\ilbbwqdcyp.exe

Filesize
255KB

MD5
da5f057f5492d12c2b65f3ed33778deb

SHA1
c0a48055beeb427af18a34732d89868cc926a52b

SHA256
fbb2ed9813d44ca5b223b3d6f49aa1a6d505efa6ff77911ff7048db019ba2afb

SHA512
b021d9fcc7f718ac8270a8eb27a47e08fd0545ab79db1a93b4a9f92fc994abae1afa69a3d98f14535bb3be04d76a5ddcedac421e69fcf9e527719c198eea6846

Download Submit
\Windows\SysWOW64\imlzbbbf.exe

Filesize
255KB

MD5
aa4c4594b7af0ac797bd1e280b3498ba

SHA1
cb10cf363c4fcaeda07f8f060dda411b26b0fa55

SHA256
d92bdb037e2456d88343364fadceee02627219afe08cb95ea72246c9b1c22104

SHA512
15f4f8d9f541112422a65214e9342512ae2a7eaab3c3373d0200bf1f4e6c6faf31c18fd9d01cbf50a3500a626c1bf1a3702beba7802c6587ab1e665419a68cc1

Download Submit
\Windows\SysWOW64\imlzbbbf.exe

Filesize
255KB

MD5
aa4c4594b7af0ac797bd1e280b3498ba

SHA1
cb10cf363c4fcaeda07f8f060dda411b26b0fa55

SHA256
d92bdb037e2456d88343364fadceee02627219afe08cb95ea72246c9b1c22104

SHA512
15f4f8d9f541112422a65214e9342512ae2a7eaab3c3373d0200bf1f4e6c6faf31c18fd9d01cbf50a3500a626c1bf1a3702beba7802c6587ab1e665419a68cc1

Download Submit
\Windows\SysWOW64\shwiqrkxgugig.exe

Filesize
255KB

MD5
5c55640333ce7a17a827e823afcc541d

SHA1
e26e53f4095dedf07c8cb943573d3b88c90e5b91

SHA256
6c32a1a85aa6a43a5b3b26553ae15693842e5dbfe48bbaf91da83d0a4094dbce

SHA512
e9c8115898e34964b2c003e9878eea0f082234e35662e48f92e4eb91f88117e1e302dc2db47831d77895e42e75db34a23101a1ee8c2bc2dbe18f49d3b97e2f54

Download Submit
\Windows\SysWOW64\shwiqrkxgugig.exe

Filesize
255KB

MD5
5c55640333ce7a17a827e823afcc541d

SHA1
e26e53f4095dedf07c8cb943573d3b88c90e5b91

SHA256
6c32a1a85aa6a43a5b3b26553ae15693842e5dbfe48bbaf91da83d0a4094dbce

SHA512
e9c8115898e34964b2c003e9878eea0f082234e35662e48f92e4eb91f88117e1e302dc2db47831d77895e42e75db34a23101a1ee8c2bc2dbe18f49d3b97e2f54

Download Submit
\Windows\SysWOW64\vfxjrhwjgfavfgi.exe

Filesize
255KB

MD5
160e00a4d2874e0d86a6be9b0b8906f9

SHA1
8aebc9c646f0156242f62cae333989ac389ace8e

SHA256
20e735db2fe74ef3bbc49393f39cbd79606d1be1ceea8207ab1403140da56efd

SHA512
a4504ba75589bb99e0ef06b1f68a1d0c5cbaabb9aa1d26a8fdae0c8659371bd937b458869749943f842e64c734ddf3be2aabedac333caea5b0e3a02385af6297

Download Submit
memory/528-102-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/528-91-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/528-116-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/528-66-0x0000000000000000-mapping.dmp

Download
memory/692-59-0x0000000000000000-mapping.dmp

Download
memory/692-101-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/692-73-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/972-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/972-63-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/972-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/972-65-0x0000000002ED0000-0x0000000002F70000-memory.dmp

Filesize
640KB

Download
memory/1048-113-0x000007FEFB851000-0x000007FEFB853000-memory.dmp

Filesize
8KB

Download
memory/1048-112-0x0000000000000000-mapping.dmp

Download
memory/1176-70-0x0000000000000000-mapping.dmp

Download
memory/1336-103-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1336-75-0x0000000000000000-mapping.dmp

Download
memory/1336-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1356-69-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1356-56-0x0000000000000000-mapping.dmp

Download
memory/1356-100-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1852-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1852-105-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1852-115-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1852-85-0x0000000000000000-mapping.dmp

Download
memory/1948-80-0x0000000000000000-mapping.dmp

Download
memory/1948-104-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1948-93-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2032-95-0x000000006FDC1000-0x000000006FDC3000-memory.dmp

Filesize
8KB

Download
memory/2032-98-0x0000000070DAD000-0x0000000070DB8000-memory.dmp

Filesize
44KB

Download
memory/2032-108-0x0000000070DAD000-0x0000000070DB8000-memory.dmp

Filesize
44KB

Download
memory/2032-88-0x0000000000000000-mapping.dmp

Download
memory/2032-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2032-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2032-90-0x0000000072341000-0x0000000072344000-memory.dmp

Filesize
12KB

Download