Analysis
-
max time kernel
181s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 16:13
Behavioral task
behavioral1
Sample
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe
Resource
win10v2004-20221111-en
General
-
Target
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe
-
Size
255KB
-
MD5
d255718aa60e1d6b71388e7f048faed3
-
SHA1
9f1b201ad15c6fb2f2abcf12c80fa73806a9d0a8
-
SHA256
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97
-
SHA512
2c95c2cd8839773517dd3b7e8f18e27ba0d246a9968ff3d1056474a0a5185001736825de529033ed586dc71e779d142cd444c804d24523b4e2e95446a0aa442a
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJc:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIP
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
dihyjxlehs.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" dihyjxlehs.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
dihyjxlehs.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dihyjxlehs.exe -
Processes:
dihyjxlehs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dihyjxlehs.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
dihyjxlehs.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dihyjxlehs.exe -
Executes dropped EXE 6 IoCs
Processes:
dihyjxlehs.exexcqltsqkwiefame.exewiuncjkd.exedoeeyscjvfgob.exewiuncjkd.exedoeeyscjvfgob.exepid process 524 dihyjxlehs.exe 268 xcqltsqkwiefame.exe 1144 wiuncjkd.exe 1356 doeeyscjvfgob.exe 548 wiuncjkd.exe 1216 doeeyscjvfgob.exe -
Processes:
resource yara_rule behavioral1/memory/1140-55-0x0000000000400000-0x00000000004A0000-memory.dmp upx \Windows\SysWOW64\dihyjxlehs.exe upx C:\Windows\SysWOW64\dihyjxlehs.exe upx \Windows\SysWOW64\xcqltsqkwiefame.exe upx C:\Windows\SysWOW64\xcqltsqkwiefame.exe upx \Windows\SysWOW64\wiuncjkd.exe upx C:\Windows\SysWOW64\dihyjxlehs.exe upx C:\Windows\SysWOW64\wiuncjkd.exe upx C:\Windows\SysWOW64\xcqltsqkwiefame.exe upx \Windows\SysWOW64\doeeyscjvfgob.exe upx C:\Windows\SysWOW64\wiuncjkd.exe upx C:\Windows\SysWOW64\doeeyscjvfgob.exe upx C:\Windows\SysWOW64\doeeyscjvfgob.exe upx \Windows\SysWOW64\doeeyscjvfgob.exe upx \Windows\SysWOW64\wiuncjkd.exe upx C:\Windows\SysWOW64\doeeyscjvfgob.exe upx C:\Windows\SysWOW64\wiuncjkd.exe upx behavioral1/memory/524-86-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/268-88-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1144-89-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1356-91-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/548-93-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1216-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1140-96-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/524-103-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/268-104-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1144-105-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1356-106-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/548-107-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral1/memory/1216-108-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe upx -
Loads dropped DLL 6 IoCs
Processes:
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exedihyjxlehs.execmd.exepid process 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 524 dihyjxlehs.exe 1812 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
dihyjxlehs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dihyjxlehs.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
xcqltsqkwiefame.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ppsrqkbz = "dihyjxlehs.exe" xcqltsqkwiefame.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kxwbulxu = "xcqltsqkwiefame.exe" xcqltsqkwiefame.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "doeeyscjvfgob.exe" xcqltsqkwiefame.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xcqltsqkwiefame.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
wiuncjkd.exedihyjxlehs.exewiuncjkd.exedescription ioc process File opened (read-only) \??\p: wiuncjkd.exe File opened (read-only) \??\x: wiuncjkd.exe File opened (read-only) \??\h: dihyjxlehs.exe File opened (read-only) \??\q: wiuncjkd.exe File opened (read-only) \??\w: wiuncjkd.exe File opened (read-only) \??\h: wiuncjkd.exe File opened (read-only) \??\o: wiuncjkd.exe File opened (read-only) \??\j: dihyjxlehs.exe File opened (read-only) \??\b: dihyjxlehs.exe File opened (read-only) \??\e: dihyjxlehs.exe File opened (read-only) \??\i: dihyjxlehs.exe File opened (read-only) \??\s: wiuncjkd.exe File opened (read-only) \??\e: wiuncjkd.exe File opened (read-only) \??\i: wiuncjkd.exe File opened (read-only) \??\j: wiuncjkd.exe File opened (read-only) \??\m: wiuncjkd.exe File opened (read-only) \??\n: dihyjxlehs.exe File opened (read-only) \??\o: dihyjxlehs.exe File opened (read-only) \??\f: wiuncjkd.exe File opened (read-only) \??\v: wiuncjkd.exe File opened (read-only) \??\v: dihyjxlehs.exe File opened (read-only) \??\y: dihyjxlehs.exe File opened (read-only) \??\t: dihyjxlehs.exe File opened (read-only) \??\p: wiuncjkd.exe File opened (read-only) \??\r: wiuncjkd.exe File opened (read-only) \??\y: wiuncjkd.exe File opened (read-only) \??\l: dihyjxlehs.exe File opened (read-only) \??\m: dihyjxlehs.exe File opened (read-only) \??\s: dihyjxlehs.exe File opened (read-only) \??\u: dihyjxlehs.exe File opened (read-only) \??\w: dihyjxlehs.exe File opened (read-only) \??\a: wiuncjkd.exe File opened (read-only) \??\e: wiuncjkd.exe File opened (read-only) \??\k: wiuncjkd.exe File opened (read-only) \??\v: wiuncjkd.exe File opened (read-only) \??\x: dihyjxlehs.exe File opened (read-only) \??\g: wiuncjkd.exe File opened (read-only) \??\t: wiuncjkd.exe File opened (read-only) \??\g: dihyjxlehs.exe File opened (read-only) \??\t: wiuncjkd.exe File opened (read-only) \??\a: wiuncjkd.exe File opened (read-only) \??\f: wiuncjkd.exe File opened (read-only) \??\k: wiuncjkd.exe File opened (read-only) \??\w: wiuncjkd.exe File opened (read-only) \??\b: wiuncjkd.exe File opened (read-only) \??\l: wiuncjkd.exe File opened (read-only) \??\n: wiuncjkd.exe File opened (read-only) \??\x: wiuncjkd.exe File opened (read-only) \??\u: wiuncjkd.exe File opened (read-only) \??\z: wiuncjkd.exe File opened (read-only) \??\a: dihyjxlehs.exe File opened (read-only) \??\b: wiuncjkd.exe File opened (read-only) \??\g: wiuncjkd.exe File opened (read-only) \??\q: dihyjxlehs.exe File opened (read-only) \??\z: dihyjxlehs.exe File opened (read-only) \??\m: wiuncjkd.exe File opened (read-only) \??\r: wiuncjkd.exe File opened (read-only) \??\q: wiuncjkd.exe File opened (read-only) \??\f: dihyjxlehs.exe File opened (read-only) \??\s: wiuncjkd.exe File opened (read-only) \??\j: wiuncjkd.exe File opened (read-only) \??\o: wiuncjkd.exe File opened (read-only) \??\y: wiuncjkd.exe File opened (read-only) \??\l: wiuncjkd.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
dihyjxlehs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" dihyjxlehs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" dihyjxlehs.exe -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1140-55-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/524-86-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/268-88-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1144-89-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1356-91-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/548-93-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1216-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1140-96-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/524-103-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/268-104-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1144-105-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1356-106-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/548-107-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral1/memory/1216-108-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exedihyjxlehs.exedescription ioc process File created C:\Windows\SysWOW64\xcqltsqkwiefame.exe 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe File created C:\Windows\SysWOW64\wiuncjkd.exe 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe File created C:\Windows\SysWOW64\doeeyscjvfgob.exe 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll dihyjxlehs.exe File created C:\Windows\SysWOW64\dihyjxlehs.exe 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe File opened for modification C:\Windows\SysWOW64\dihyjxlehs.exe 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe File opened for modification C:\Windows\SysWOW64\xcqltsqkwiefame.exe 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe File opened for modification C:\Windows\SysWOW64\wiuncjkd.exe 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe File opened for modification C:\Windows\SysWOW64\doeeyscjvfgob.exe 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe -
Drops file in Program Files directory 14 IoCs
Processes:
wiuncjkd.exewiuncjkd.exedescription ioc process File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe wiuncjkd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe wiuncjkd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal wiuncjkd.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe wiuncjkd.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe wiuncjkd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe wiuncjkd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal wiuncjkd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal wiuncjkd.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe wiuncjkd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe wiuncjkd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal wiuncjkd.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe wiuncjkd.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe wiuncjkd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe wiuncjkd.exe -
Drops file in Windows directory 5 IoCs
Processes:
WINWORD.EXE332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exedescription ioc process File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdihyjxlehs.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh dihyjxlehs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc dihyjxlehs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg dihyjxlehs.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" dihyjxlehs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1536 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exedihyjxlehs.exewiuncjkd.exexcqltsqkwiefame.exedoeeyscjvfgob.exewiuncjkd.exedoeeyscjvfgob.exepid process 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 524 dihyjxlehs.exe 524 dihyjxlehs.exe 524 dihyjxlehs.exe 524 dihyjxlehs.exe 524 dihyjxlehs.exe 1144 wiuncjkd.exe 1144 wiuncjkd.exe 1144 wiuncjkd.exe 1144 wiuncjkd.exe 268 xcqltsqkwiefame.exe 268 xcqltsqkwiefame.exe 268 xcqltsqkwiefame.exe 268 xcqltsqkwiefame.exe 268 xcqltsqkwiefame.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 548 wiuncjkd.exe 548 wiuncjkd.exe 548 wiuncjkd.exe 548 wiuncjkd.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 268 xcqltsqkwiefame.exe 268 xcqltsqkwiefame.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 268 xcqltsqkwiefame.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 268 xcqltsqkwiefame.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 268 xcqltsqkwiefame.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 268 xcqltsqkwiefame.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 268 xcqltsqkwiefame.exe 1216 doeeyscjvfgob.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
Processes:
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exedihyjxlehs.exexcqltsqkwiefame.exewiuncjkd.exedoeeyscjvfgob.exewiuncjkd.exedoeeyscjvfgob.exepid process 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 524 dihyjxlehs.exe 524 dihyjxlehs.exe 524 dihyjxlehs.exe 268 xcqltsqkwiefame.exe 268 xcqltsqkwiefame.exe 268 xcqltsqkwiefame.exe 1144 wiuncjkd.exe 1144 wiuncjkd.exe 1144 wiuncjkd.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 548 wiuncjkd.exe 548 wiuncjkd.exe 548 wiuncjkd.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe -
Suspicious use of SendNotifyMessage 21 IoCs
Processes:
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exedihyjxlehs.exexcqltsqkwiefame.exewiuncjkd.exedoeeyscjvfgob.exewiuncjkd.exedoeeyscjvfgob.exepid process 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe 524 dihyjxlehs.exe 524 dihyjxlehs.exe 524 dihyjxlehs.exe 268 xcqltsqkwiefame.exe 268 xcqltsqkwiefame.exe 268 xcqltsqkwiefame.exe 1144 wiuncjkd.exe 1144 wiuncjkd.exe 1144 wiuncjkd.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 1356 doeeyscjvfgob.exe 548 wiuncjkd.exe 548 wiuncjkd.exe 548 wiuncjkd.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe 1216 doeeyscjvfgob.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1536 WINWORD.EXE 1536 WINWORD.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exexcqltsqkwiefame.exedihyjxlehs.execmd.exeWINWORD.EXEdescription pid process target process PID 1140 wrote to memory of 524 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe dihyjxlehs.exe PID 1140 wrote to memory of 524 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe dihyjxlehs.exe PID 1140 wrote to memory of 524 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe dihyjxlehs.exe PID 1140 wrote to memory of 524 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe dihyjxlehs.exe PID 1140 wrote to memory of 268 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe xcqltsqkwiefame.exe PID 1140 wrote to memory of 268 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe xcqltsqkwiefame.exe PID 1140 wrote to memory of 268 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe xcqltsqkwiefame.exe PID 1140 wrote to memory of 268 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe xcqltsqkwiefame.exe PID 1140 wrote to memory of 1144 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe wiuncjkd.exe PID 1140 wrote to memory of 1144 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe wiuncjkd.exe PID 1140 wrote to memory of 1144 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe wiuncjkd.exe PID 1140 wrote to memory of 1144 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe wiuncjkd.exe PID 1140 wrote to memory of 1356 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe doeeyscjvfgob.exe PID 1140 wrote to memory of 1356 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe doeeyscjvfgob.exe PID 1140 wrote to memory of 1356 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe doeeyscjvfgob.exe PID 1140 wrote to memory of 1356 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe doeeyscjvfgob.exe PID 268 wrote to memory of 1812 268 xcqltsqkwiefame.exe cmd.exe PID 268 wrote to memory of 1812 268 xcqltsqkwiefame.exe cmd.exe PID 268 wrote to memory of 1812 268 xcqltsqkwiefame.exe cmd.exe PID 268 wrote to memory of 1812 268 xcqltsqkwiefame.exe cmd.exe PID 524 wrote to memory of 548 524 dihyjxlehs.exe wiuncjkd.exe PID 524 wrote to memory of 548 524 dihyjxlehs.exe wiuncjkd.exe PID 524 wrote to memory of 548 524 dihyjxlehs.exe wiuncjkd.exe PID 524 wrote to memory of 548 524 dihyjxlehs.exe wiuncjkd.exe PID 1812 wrote to memory of 1216 1812 cmd.exe doeeyscjvfgob.exe PID 1812 wrote to memory of 1216 1812 cmd.exe doeeyscjvfgob.exe PID 1812 wrote to memory of 1216 1812 cmd.exe doeeyscjvfgob.exe PID 1812 wrote to memory of 1216 1812 cmd.exe doeeyscjvfgob.exe PID 1140 wrote to memory of 1536 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe WINWORD.EXE PID 1140 wrote to memory of 1536 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe WINWORD.EXE PID 1140 wrote to memory of 1536 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe WINWORD.EXE PID 1140 wrote to memory of 1536 1140 332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe WINWORD.EXE PID 1536 wrote to memory of 1972 1536 WINWORD.EXE splwow64.exe PID 1536 wrote to memory of 1972 1536 WINWORD.EXE splwow64.exe PID 1536 wrote to memory of 1972 1536 WINWORD.EXE splwow64.exe PID 1536 wrote to memory of 1972 1536 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe"C:\Users\Admin\AppData\Local\Temp\332c464efb4db606d95ac6457519b58db4c1bc715d0641c802534b5b56112a97.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dihyjxlehs.exedihyjxlehs.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wiuncjkd.exeC:\Windows\system32\wiuncjkd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\xcqltsqkwiefame.exexcqltsqkwiefame.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c doeeyscjvfgob.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\doeeyscjvfgob.exedoeeyscjvfgob.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\wiuncjkd.exewiuncjkd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\doeeyscjvfgob.exedoeeyscjvfgob.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
7Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exeFilesize
255KB
MD5d5a387aa6f51902cd2adfd3c4dcdf6ab
SHA176d85910777f2107861624d878f3e36fed69c390
SHA25640d2f957a7236a235fcfdbb9b1a1be0f340ce404fb0ae1532e7c9e28c3078e76
SHA5124e023ae729bbbeb4f63f9b5f2fcc5cc82096d4dddb738f3f378e81c58a8f9bc8be2f054cee6dd941395c41d9b0ff1022a1b64154730964b757aeef6d68f8cdc1
-
C:\Windows\SysWOW64\dihyjxlehs.exeFilesize
255KB
MD57e0cae0a95cce1d503df4bcc2735c375
SHA1866207b0a552a09677167db7ed2d40f2708b9a05
SHA2569a162c8c93c5d51f6d3a3607d51862508b7185ea237021fc4b1acb0ee526d288
SHA512d074679729c892553a7d0d4c91d24c906a06fbd133e82c5b8add49841440ae4247804330db711fb8865a6d849f7ed9ad4c5bc958079fa423e3e81550daf57916
-
C:\Windows\SysWOW64\dihyjxlehs.exeFilesize
255KB
MD57e0cae0a95cce1d503df4bcc2735c375
SHA1866207b0a552a09677167db7ed2d40f2708b9a05
SHA2569a162c8c93c5d51f6d3a3607d51862508b7185ea237021fc4b1acb0ee526d288
SHA512d074679729c892553a7d0d4c91d24c906a06fbd133e82c5b8add49841440ae4247804330db711fb8865a6d849f7ed9ad4c5bc958079fa423e3e81550daf57916
-
C:\Windows\SysWOW64\doeeyscjvfgob.exeFilesize
255KB
MD5ca281fb99b4b716635bf284a3f093070
SHA118d9b13f70c504337e81e363b9c3ae1a45ca9ce7
SHA25658436b20cfd1bf265c3938bdc61f5266d8d1cabc82c17c5fdfa94332beb7c8bd
SHA512caeb5890ff5da53c4a12d93010d7399c6b693c4ac7414fd8a45c0c51d28451a69fa8d55eff4b50cd1f77df9d718f67bdc5aad65f5d710f6ec43ca9b5f7100fe0
-
C:\Windows\SysWOW64\doeeyscjvfgob.exeFilesize
255KB
MD5ca281fb99b4b716635bf284a3f093070
SHA118d9b13f70c504337e81e363b9c3ae1a45ca9ce7
SHA25658436b20cfd1bf265c3938bdc61f5266d8d1cabc82c17c5fdfa94332beb7c8bd
SHA512caeb5890ff5da53c4a12d93010d7399c6b693c4ac7414fd8a45c0c51d28451a69fa8d55eff4b50cd1f77df9d718f67bdc5aad65f5d710f6ec43ca9b5f7100fe0
-
C:\Windows\SysWOW64\doeeyscjvfgob.exeFilesize
255KB
MD5ca281fb99b4b716635bf284a3f093070
SHA118d9b13f70c504337e81e363b9c3ae1a45ca9ce7
SHA25658436b20cfd1bf265c3938bdc61f5266d8d1cabc82c17c5fdfa94332beb7c8bd
SHA512caeb5890ff5da53c4a12d93010d7399c6b693c4ac7414fd8a45c0c51d28451a69fa8d55eff4b50cd1f77df9d718f67bdc5aad65f5d710f6ec43ca9b5f7100fe0
-
C:\Windows\SysWOW64\wiuncjkd.exeFilesize
255KB
MD589ad266dd4ec3baf32c36208801d94b2
SHA11e23ae264771960f0ae985802359208f0c8049c2
SHA2560c3e23542476324296cf465452a520b4b7896f236c818b113af69284ccb076fb
SHA512da966a58cfecc2494730c9f486a90a5227ded64b2f4d35c70535e44347575bfe218dfd478c36a2a63261f034c76a66d7da5144761fcee858dff4ddc37fea02c2
-
C:\Windows\SysWOW64\wiuncjkd.exeFilesize
255KB
MD589ad266dd4ec3baf32c36208801d94b2
SHA11e23ae264771960f0ae985802359208f0c8049c2
SHA2560c3e23542476324296cf465452a520b4b7896f236c818b113af69284ccb076fb
SHA512da966a58cfecc2494730c9f486a90a5227ded64b2f4d35c70535e44347575bfe218dfd478c36a2a63261f034c76a66d7da5144761fcee858dff4ddc37fea02c2
-
C:\Windows\SysWOW64\wiuncjkd.exeFilesize
255KB
MD589ad266dd4ec3baf32c36208801d94b2
SHA11e23ae264771960f0ae985802359208f0c8049c2
SHA2560c3e23542476324296cf465452a520b4b7896f236c818b113af69284ccb076fb
SHA512da966a58cfecc2494730c9f486a90a5227ded64b2f4d35c70535e44347575bfe218dfd478c36a2a63261f034c76a66d7da5144761fcee858dff4ddc37fea02c2
-
C:\Windows\SysWOW64\xcqltsqkwiefame.exeFilesize
255KB
MD5bfa77640859efcebaf136d3e9972e7d1
SHA1964cd19df5457e5b2c3edffd053211da4c15f0a1
SHA2566e0d42be1879f53d4e830c8fec1909405a53d9c24f6c7069a50f6fa334772424
SHA5127120aecfb7f3236d4f425502ed29676677af06b09791d8b368a6b41fea32241d9732d35cafc26d4b0227bb79e2b9c1b33267887e7c2bf61340a4b9d8f8e4d5da
-
C:\Windows\SysWOW64\xcqltsqkwiefame.exeFilesize
255KB
MD5bfa77640859efcebaf136d3e9972e7d1
SHA1964cd19df5457e5b2c3edffd053211da4c15f0a1
SHA2566e0d42be1879f53d4e830c8fec1909405a53d9c24f6c7069a50f6fa334772424
SHA5127120aecfb7f3236d4f425502ed29676677af06b09791d8b368a6b41fea32241d9732d35cafc26d4b0227bb79e2b9c1b33267887e7c2bf61340a4b9d8f8e4d5da
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\Windows\SysWOW64\dihyjxlehs.exeFilesize
255KB
MD57e0cae0a95cce1d503df4bcc2735c375
SHA1866207b0a552a09677167db7ed2d40f2708b9a05
SHA2569a162c8c93c5d51f6d3a3607d51862508b7185ea237021fc4b1acb0ee526d288
SHA512d074679729c892553a7d0d4c91d24c906a06fbd133e82c5b8add49841440ae4247804330db711fb8865a6d849f7ed9ad4c5bc958079fa423e3e81550daf57916
-
\Windows\SysWOW64\doeeyscjvfgob.exeFilesize
255KB
MD5ca281fb99b4b716635bf284a3f093070
SHA118d9b13f70c504337e81e363b9c3ae1a45ca9ce7
SHA25658436b20cfd1bf265c3938bdc61f5266d8d1cabc82c17c5fdfa94332beb7c8bd
SHA512caeb5890ff5da53c4a12d93010d7399c6b693c4ac7414fd8a45c0c51d28451a69fa8d55eff4b50cd1f77df9d718f67bdc5aad65f5d710f6ec43ca9b5f7100fe0
-
\Windows\SysWOW64\doeeyscjvfgob.exeFilesize
255KB
MD5ca281fb99b4b716635bf284a3f093070
SHA118d9b13f70c504337e81e363b9c3ae1a45ca9ce7
SHA25658436b20cfd1bf265c3938bdc61f5266d8d1cabc82c17c5fdfa94332beb7c8bd
SHA512caeb5890ff5da53c4a12d93010d7399c6b693c4ac7414fd8a45c0c51d28451a69fa8d55eff4b50cd1f77df9d718f67bdc5aad65f5d710f6ec43ca9b5f7100fe0
-
\Windows\SysWOW64\wiuncjkd.exeFilesize
255KB
MD589ad266dd4ec3baf32c36208801d94b2
SHA11e23ae264771960f0ae985802359208f0c8049c2
SHA2560c3e23542476324296cf465452a520b4b7896f236c818b113af69284ccb076fb
SHA512da966a58cfecc2494730c9f486a90a5227ded64b2f4d35c70535e44347575bfe218dfd478c36a2a63261f034c76a66d7da5144761fcee858dff4ddc37fea02c2
-
\Windows\SysWOW64\wiuncjkd.exeFilesize
255KB
MD589ad266dd4ec3baf32c36208801d94b2
SHA11e23ae264771960f0ae985802359208f0c8049c2
SHA2560c3e23542476324296cf465452a520b4b7896f236c818b113af69284ccb076fb
SHA512da966a58cfecc2494730c9f486a90a5227ded64b2f4d35c70535e44347575bfe218dfd478c36a2a63261f034c76a66d7da5144761fcee858dff4ddc37fea02c2
-
\Windows\SysWOW64\xcqltsqkwiefame.exeFilesize
255KB
MD5bfa77640859efcebaf136d3e9972e7d1
SHA1964cd19df5457e5b2c3edffd053211da4c15f0a1
SHA2566e0d42be1879f53d4e830c8fec1909405a53d9c24f6c7069a50f6fa334772424
SHA5127120aecfb7f3236d4f425502ed29676677af06b09791d8b368a6b41fea32241d9732d35cafc26d4b0227bb79e2b9c1b33267887e7c2bf61340a4b9d8f8e4d5da
-
memory/268-61-0x0000000000000000-mapping.dmp
-
memory/268-88-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/268-104-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/524-103-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/524-57-0x0000000000000000-mapping.dmp
-
memory/524-86-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/524-92-0x0000000003860000-0x0000000003900000-memory.dmpFilesize
640KB
-
memory/548-78-0x0000000000000000-mapping.dmp
-
memory/548-107-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/548-93-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1140-85-0x00000000032E0000-0x0000000003380000-memory.dmpFilesize
640KB
-
memory/1140-90-0x00000000032E0000-0x0000000003380000-memory.dmpFilesize
640KB
-
memory/1140-87-0x00000000032E0000-0x0000000003380000-memory.dmpFilesize
640KB
-
memory/1140-55-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1140-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/1140-96-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1144-105-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1144-89-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1144-66-0x0000000000000000-mapping.dmp
-
memory/1216-108-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1216-94-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1216-80-0x0000000000000000-mapping.dmp
-
memory/1356-71-0x0000000000000000-mapping.dmp
-
memory/1356-106-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1356-91-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1536-101-0x000000007175D000-0x0000000071768000-memory.dmpFilesize
44KB
-
memory/1536-99-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1536-98-0x0000000070771000-0x0000000070773000-memory.dmpFilesize
8KB
-
memory/1536-97-0x0000000072CF1000-0x0000000072CF4000-memory.dmpFilesize
12KB
-
memory/1536-95-0x0000000000000000-mapping.dmp
-
memory/1536-112-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1536-109-0x000000007175D000-0x0000000071768000-memory.dmpFilesize
44KB
-
memory/1536-113-0x000000007175D000-0x0000000071768000-memory.dmpFilesize
44KB
-
memory/1812-76-0x0000000000000000-mapping.dmp
-
memory/1972-111-0x000007FEFC201000-0x000007FEFC203000-memory.dmpFilesize
8KB
-
memory/1972-110-0x0000000000000000-mapping.dmp