e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c

Analysis

max time kernel
150s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
Size

255KB
MD5

2585f8560b096706283512ffb787afc0
SHA1

680c4d291f92aa9f454ff53f20530cb330585a88
SHA256

e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c
SHA512

fcfd18cd32a342d81460116dab963d302f2e2183a653b4a268361ab5b328be4a364e99a33961935a2fdb11acb329d3a1460d24b804ca42a95927f2ed168df656
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ+:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIb

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	bhaqaxrhmx.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	bhaqaxrhmx.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bhaqaxrhmx.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhaqaxrhmx.exe

Executes dropped EXE 6 IoCs

pid	Process
840	bhaqaxrhmx.exe
1680	zweiovofflsitzx.exe
580	ocujipjx.exe
332	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
980	ocujipjx.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000005c51-55.dat	upx
behavioral1/files/0x0008000000005c51-57.dat	upx
behavioral1/files/0x0009000000013a09-59.dat	upx
behavioral1/files/0x0007000000014219-64.dat	upx
behavioral1/files/0x0009000000013a09-68.dat	upx
behavioral1/files/0x000600000001422b-71.dat	upx
behavioral1/files/0x000600000001422b-69.dat	upx
behavioral1/files/0x0007000000014219-66.dat	upx
behavioral1/files/0x0009000000013a09-62.dat	upx
behavioral1/files/0x0008000000005c51-61.dat	upx
behavioral1/files/0x0007000000014219-74.dat	upx
behavioral1/files/0x000600000001422b-73.dat	upx
behavioral1/files/0x000600000001422b-76.dat	upx
behavioral1/files/0x000600000001422b-78.dat	upx
behavioral1/memory/860-80-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/840-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1680-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/580-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/332-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1408-89-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0007000000014219-90.dat	upx
behavioral1/files/0x0007000000014219-92.dat	upx
behavioral1/memory/860-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/980-99-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0006000000014bb0-104.dat	upx
behavioral1/memory/840-105-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1680-106-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/580-107-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/332-108-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1408-109-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/980-110-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/980-116-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/580-117-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
584	cmd.exe
840	bhaqaxrhmx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	bhaqaxrhmx.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	zweiovofflsitzx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\byuunfat = "bhaqaxrhmx.exe"	zweiovofflsitzx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lihokhzx = "zweiovofflsitzx.exe"	zweiovofflsitzx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ugdszvgprvzkf.exe"	zweiovofflsitzx.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	ocujipjx.exe
File opened (read-only)	\??\s:	ocujipjx.exe
File opened (read-only)	\??\y:	bhaqaxrhmx.exe
File opened (read-only)	\??\b:	ocujipjx.exe
File opened (read-only)	\??\p:	bhaqaxrhmx.exe
File opened (read-only)	\??\w:	bhaqaxrhmx.exe
File opened (read-only)	\??\l:	ocujipjx.exe
File opened (read-only)	\??\q:	ocujipjx.exe
File opened (read-only)	\??\r:	ocujipjx.exe
File opened (read-only)	\??\o:	ocujipjx.exe
File opened (read-only)	\??\w:	ocujipjx.exe
File opened (read-only)	\??\q:	bhaqaxrhmx.exe
File opened (read-only)	\??\j:	ocujipjx.exe
File opened (read-only)	\??\n:	ocujipjx.exe
File opened (read-only)	\??\s:	bhaqaxrhmx.exe
File opened (read-only)	\??\m:	ocujipjx.exe
File opened (read-only)	\??\v:	ocujipjx.exe
File opened (read-only)	\??\l:	bhaqaxrhmx.exe
File opened (read-only)	\??\b:	ocujipjx.exe
File opened (read-only)	\??\i:	ocujipjx.exe
File opened (read-only)	\??\t:	ocujipjx.exe
File opened (read-only)	\??\j:	bhaqaxrhmx.exe
File opened (read-only)	\??\u:	bhaqaxrhmx.exe
File opened (read-only)	\??\m:	bhaqaxrhmx.exe
File opened (read-only)	\??\k:	ocujipjx.exe
File opened (read-only)	\??\q:	ocujipjx.exe
File opened (read-only)	\??\g:	bhaqaxrhmx.exe
File opened (read-only)	\??\h:	ocujipjx.exe
File opened (read-only)	\??\o:	ocujipjx.exe
File opened (read-only)	\??\t:	ocujipjx.exe
File opened (read-only)	\??\z:	ocujipjx.exe
File opened (read-only)	\??\a:	bhaqaxrhmx.exe
File opened (read-only)	\??\e:	ocujipjx.exe
File opened (read-only)	\??\b:	bhaqaxrhmx.exe
File opened (read-only)	\??\h:	bhaqaxrhmx.exe
File opened (read-only)	\??\g:	ocujipjx.exe
File opened (read-only)	\??\p:	ocujipjx.exe
File opened (read-only)	\??\y:	ocujipjx.exe
File opened (read-only)	\??\h:	ocujipjx.exe
File opened (read-only)	\??\o:	bhaqaxrhmx.exe
File opened (read-only)	\??\v:	bhaqaxrhmx.exe
File opened (read-only)	\??\u:	ocujipjx.exe
File opened (read-only)	\??\f:	ocujipjx.exe
File opened (read-only)	\??\i:	bhaqaxrhmx.exe
File opened (read-only)	\??\j:	ocujipjx.exe
File opened (read-only)	\??\t:	bhaqaxrhmx.exe
File opened (read-only)	\??\i:	ocujipjx.exe
File opened (read-only)	\??\e:	bhaqaxrhmx.exe
File opened (read-only)	\??\k:	bhaqaxrhmx.exe
File opened (read-only)	\??\x:	bhaqaxrhmx.exe
File opened (read-only)	\??\z:	bhaqaxrhmx.exe
File opened (read-only)	\??\k:	ocujipjx.exe
File opened (read-only)	\??\n:	ocujipjx.exe
File opened (read-only)	\??\v:	ocujipjx.exe
File opened (read-only)	\??\g:	ocujipjx.exe
File opened (read-only)	\??\x:	ocujipjx.exe
File opened (read-only)	\??\n:	bhaqaxrhmx.exe
File opened (read-only)	\??\y:	ocujipjx.exe
File opened (read-only)	\??\a:	ocujipjx.exe
File opened (read-only)	\??\s:	ocujipjx.exe
File opened (read-only)	\??\a:	ocujipjx.exe
File opened (read-only)	\??\m:	ocujipjx.exe
File opened (read-only)	\??\r:	ocujipjx.exe
File opened (read-only)	\??\f:	bhaqaxrhmx.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	bhaqaxrhmx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	bhaqaxrhmx.exe

AutoIT Executable 19 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/860-80-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/840-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1680-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/860-84-0x0000000002F30000-0x0000000002FD0000-memory.dmp	autoit_exe
behavioral1/memory/580-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/860-86-0x0000000002F30000-0x0000000002FD0000-memory.dmp	autoit_exe
behavioral1/memory/332-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1408-89-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/860-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/840-98-0x0000000003870000-0x0000000003910000-memory.dmp	autoit_exe
behavioral1/memory/980-99-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/840-105-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1680-106-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/580-107-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/332-108-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1408-109-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/980-110-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/980-116-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/580-117-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ugdszvgprvzkf.exe	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
File created	C:\Windows\SysWOW64\ocujipjx.exe	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
File opened for modification	C:\Windows\SysWOW64\ocujipjx.exe	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
File created	C:\Windows\SysWOW64\ugdszvgprvzkf.exe	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	bhaqaxrhmx.exe
File created	C:\Windows\SysWOW64\bhaqaxrhmx.exe	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
File opened for modification	C:\Windows\SysWOW64\bhaqaxrhmx.exe	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
File created	C:\Windows\SysWOW64\zweiovofflsitzx.exe	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
File opened for modification	C:\Windows\SysWOW64\zweiovofflsitzx.exe	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ocujipjx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	ocujipjx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	ocujipjx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ocujipjx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ocujipjx.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ocujipjx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ocujipjx.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ocujipjx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ocujipjx.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	ocujipjx.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ocujipjx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	ocujipjx.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	ocujipjx.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	ocujipjx.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	bhaqaxrhmx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC6781593DAB4B8CF7C95EC9437BA"	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	bhaqaxrhmx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1576	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
1680	zweiovofflsitzx.exe
1680	zweiovofflsitzx.exe
1680	zweiovofflsitzx.exe
1680	zweiovofflsitzx.exe
1680	zweiovofflsitzx.exe
840	bhaqaxrhmx.exe
840	bhaqaxrhmx.exe
840	bhaqaxrhmx.exe
840	bhaqaxrhmx.exe
840	bhaqaxrhmx.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
580	ocujipjx.exe
580	ocujipjx.exe
580	ocujipjx.exe
580	ocujipjx.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1680	zweiovofflsitzx.exe
980	ocujipjx.exe
980	ocujipjx.exe
980	ocujipjx.exe
980	ocujipjx.exe
1680	zweiovofflsitzx.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
1680	zweiovofflsitzx.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1680	zweiovofflsitzx.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1680	zweiovofflsitzx.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1680	zweiovofflsitzx.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
840	bhaqaxrhmx.exe
840	bhaqaxrhmx.exe
840	bhaqaxrhmx.exe
1680	zweiovofflsitzx.exe
1680	zweiovofflsitzx.exe
1680	zweiovofflsitzx.exe
332	ugdszvgprvzkf.exe
580	ocujipjx.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
580	ocujipjx.exe
580	ocujipjx.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
980	ocujipjx.exe
980	ocujipjx.exe
980	ocujipjx.exe

Suspicious use of SendNotifyMessage 21 IoCs

pid	Process
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
840	bhaqaxrhmx.exe
840	bhaqaxrhmx.exe
840	bhaqaxrhmx.exe
1680	zweiovofflsitzx.exe
1680	zweiovofflsitzx.exe
1680	zweiovofflsitzx.exe
332	ugdszvgprvzkf.exe
580	ocujipjx.exe
332	ugdszvgprvzkf.exe
332	ugdszvgprvzkf.exe
580	ocujipjx.exe
580	ocujipjx.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
1408	ugdszvgprvzkf.exe
980	ocujipjx.exe
980	ocujipjx.exe
980	ocujipjx.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1576	WINWORD.EXE
1576	WINWORD.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 840	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	27
PID 860 wrote to memory of 840	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	27
PID 860 wrote to memory of 840	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	27
PID 860 wrote to memory of 840	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	27
PID 860 wrote to memory of 1680	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	28
PID 860 wrote to memory of 1680	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	28
PID 860 wrote to memory of 1680	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	28
PID 860 wrote to memory of 1680	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	28
PID 860 wrote to memory of 580	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	29
PID 860 wrote to memory of 580	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	29
PID 860 wrote to memory of 580	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	29
PID 860 wrote to memory of 580	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	29
PID 860 wrote to memory of 332	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	30
PID 860 wrote to memory of 332	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	30
PID 860 wrote to memory of 332	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	30
PID 860 wrote to memory of 332	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	30
PID 1680 wrote to memory of 584	1680	zweiovofflsitzx.exe	31
PID 1680 wrote to memory of 584	1680	zweiovofflsitzx.exe	31
PID 1680 wrote to memory of 584	1680	zweiovofflsitzx.exe	31
PID 1680 wrote to memory of 584	1680	zweiovofflsitzx.exe	31
PID 584 wrote to memory of 1408	584	cmd.exe	33
PID 584 wrote to memory of 1408	584	cmd.exe	33
PID 584 wrote to memory of 1408	584	cmd.exe	33
PID 584 wrote to memory of 1408	584	cmd.exe	33
PID 840 wrote to memory of 980	840	bhaqaxrhmx.exe	34
PID 840 wrote to memory of 980	840	bhaqaxrhmx.exe	34
PID 840 wrote to memory of 980	840	bhaqaxrhmx.exe	34
PID 840 wrote to memory of 980	840	bhaqaxrhmx.exe	34
PID 860 wrote to memory of 1576	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	35
PID 860 wrote to memory of 1576	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	35
PID 860 wrote to memory of 1576	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	35
PID 860 wrote to memory of 1576	860	e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe	35
PID 1576 wrote to memory of 588	1576	WINWORD.EXE	39
PID 1576 wrote to memory of 588	1576	WINWORD.EXE	39
PID 1576 wrote to memory of 588	1576	WINWORD.EXE	39
PID 1576 wrote to memory of 588	1576	WINWORD.EXE	39

C:\Users\Admin\AppData\Local\Temp\e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe
"C:\Users\Admin\AppData\Local\Temp\e42961fbad9cd1334744a914b7382673d1ff416f4be4f6ca69e0cb65e271c95c.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:860
- C:\Windows\SysWOW64\bhaqaxrhmx.exe
  bhaqaxrhmx.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\ocujipjx.exe
    C:\Windows\system32\ocujipjx.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:980
- C:\Windows\SysWOW64\zweiovofflsitzx.exe
  zweiovofflsitzx.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ugdszvgprvzkf.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:584
  - - C:\Windows\SysWOW64\ugdszvgprvzkf.exe
      ugdszvgprvzkf.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1408
- C:\Windows\SysWOW64\ocujipjx.exe
  ocujipjx.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:580
- C:\Windows\SysWOW64\ugdszvgprvzkf.exe
  ugdszvgprvzkf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:332
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
1385fbf8cf19e4484d29a6fb1a92c9ab

SHA1
692efe3654af93759ce26fb52d92ccbd301ebdb3

SHA256
0f08968d60fdf7ea2de0a09e42fe0974c9884ae45dbd055543c429d50deeaa0c

SHA512
8776aac36911cc2fb4bab928ec83fe0e49ea9a3538355b578daaab000f2a9319cad7d7abd13fc4b1d0098a5ded9597d7dd9e046ff43a1fc162130018b3d6a002

Download Submit
C:\Windows\SysWOW64\bhaqaxrhmx.exe

Filesize
255KB

MD5
f09bb6d456047bbfc988a3686f819132

SHA1
d77e14c731741f7ee238e66f1b020efb4e88c683

SHA256
05e22593ef4c167f594c1e63b4f48f042ea94500e46f5c2a6deec8da6d76e8c5

SHA512
9d5ddf85d44b58a96a42855423bf23ad917ae52fed488dad78cc20077b02cb327400e2303e0d77a9e2c20682bf6d3b0e2a0c956cd90f8a6a5b9d9d1bd23d2d57

Download Submit
C:\Windows\SysWOW64\bhaqaxrhmx.exe

Filesize
255KB

MD5
f09bb6d456047bbfc988a3686f819132

SHA1
d77e14c731741f7ee238e66f1b020efb4e88c683

SHA256
05e22593ef4c167f594c1e63b4f48f042ea94500e46f5c2a6deec8da6d76e8c5

SHA512
9d5ddf85d44b58a96a42855423bf23ad917ae52fed488dad78cc20077b02cb327400e2303e0d77a9e2c20682bf6d3b0e2a0c956cd90f8a6a5b9d9d1bd23d2d57

Download Submit
C:\Windows\SysWOW64\ocujipjx.exe

Filesize
255KB

MD5
00118f5a3d1c7bc4f1e614246ea610c1

SHA1
5bad0a82554c1467d451e0477a85e4cbb3958277

SHA256
56f1ba6fd2d470169e4327db241f94304ba042265534c9cddbab60ad84f5acbb

SHA512
b60fe7c1f639c038c293d06894860c26b42205f65cce69b78d1fcedcfb1efb4c6def00640443dfe488aa3a1c808ba2929f977a73cfffad25ebcd021e9528da8d

Download Submit
C:\Windows\SysWOW64\ocujipjx.exe

Filesize
255KB

MD5
00118f5a3d1c7bc4f1e614246ea610c1

SHA1
5bad0a82554c1467d451e0477a85e4cbb3958277

SHA256
56f1ba6fd2d470169e4327db241f94304ba042265534c9cddbab60ad84f5acbb

SHA512
b60fe7c1f639c038c293d06894860c26b42205f65cce69b78d1fcedcfb1efb4c6def00640443dfe488aa3a1c808ba2929f977a73cfffad25ebcd021e9528da8d

Download Submit
C:\Windows\SysWOW64\ocujipjx.exe

Filesize
255KB

MD5
00118f5a3d1c7bc4f1e614246ea610c1

SHA1
5bad0a82554c1467d451e0477a85e4cbb3958277

SHA256
56f1ba6fd2d470169e4327db241f94304ba042265534c9cddbab60ad84f5acbb

SHA512
b60fe7c1f639c038c293d06894860c26b42205f65cce69b78d1fcedcfb1efb4c6def00640443dfe488aa3a1c808ba2929f977a73cfffad25ebcd021e9528da8d

Download Submit
C:\Windows\SysWOW64\ugdszvgprvzkf.exe

Filesize
255KB

MD5
49f0fd66f78d0ddf0f2057599ab5130d

SHA1
c38c0ce8ae5697853268c0c791dc789c65ad5a41

SHA256
824e8d3ef9bcc8ecb7c7c921fa347099b8b2fccc6b521db2597d9ac0700ab142

SHA512
79a6d38e5e841edca743df2a85d64b86ec571ec8678c63ccc4420e2c9cc5aae25aec40be5514f8f5f3240456e923f8333d0255e8b6c2d6efc8c626fb6a60713c

Download Submit
C:\Windows\SysWOW64\ugdszvgprvzkf.exe

Filesize
255KB

MD5
49f0fd66f78d0ddf0f2057599ab5130d

SHA1
c38c0ce8ae5697853268c0c791dc789c65ad5a41

SHA256
824e8d3ef9bcc8ecb7c7c921fa347099b8b2fccc6b521db2597d9ac0700ab142

SHA512
79a6d38e5e841edca743df2a85d64b86ec571ec8678c63ccc4420e2c9cc5aae25aec40be5514f8f5f3240456e923f8333d0255e8b6c2d6efc8c626fb6a60713c

Download Submit
C:\Windows\SysWOW64\ugdszvgprvzkf.exe

Filesize
255KB

MD5
49f0fd66f78d0ddf0f2057599ab5130d

SHA1
c38c0ce8ae5697853268c0c791dc789c65ad5a41

SHA256
824e8d3ef9bcc8ecb7c7c921fa347099b8b2fccc6b521db2597d9ac0700ab142

SHA512
79a6d38e5e841edca743df2a85d64b86ec571ec8678c63ccc4420e2c9cc5aae25aec40be5514f8f5f3240456e923f8333d0255e8b6c2d6efc8c626fb6a60713c

Download Submit
C:\Windows\SysWOW64\zweiovofflsitzx.exe

Filesize
255KB

MD5
372ce737f63fe9bb5125fa9a2c2b474a

SHA1
b608e899b48ac3cd10ba47b632cb894330819fe9

SHA256
fc31737d4583883747eaf659469e8776516be3c4469993cd20123492ceda2e0d

SHA512
65ce2c0edac419dfa42d432a006599453381e8167af21a945f6b9a43fa50edb6badb0f1c0f35552ad8c843b47e8aefd2cf083c38e90ebdb033d9915ec13450ff

Download Submit
C:\Windows\SysWOW64\zweiovofflsitzx.exe

Filesize
255KB

MD5
372ce737f63fe9bb5125fa9a2c2b474a

SHA1
b608e899b48ac3cd10ba47b632cb894330819fe9

SHA256
fc31737d4583883747eaf659469e8776516be3c4469993cd20123492ceda2e0d

SHA512
65ce2c0edac419dfa42d432a006599453381e8167af21a945f6b9a43fa50edb6badb0f1c0f35552ad8c843b47e8aefd2cf083c38e90ebdb033d9915ec13450ff

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\bhaqaxrhmx.exe

Filesize
255KB

MD5
f09bb6d456047bbfc988a3686f819132

SHA1
d77e14c731741f7ee238e66f1b020efb4e88c683

SHA256
05e22593ef4c167f594c1e63b4f48f042ea94500e46f5c2a6deec8da6d76e8c5

SHA512
9d5ddf85d44b58a96a42855423bf23ad917ae52fed488dad78cc20077b02cb327400e2303e0d77a9e2c20682bf6d3b0e2a0c956cd90f8a6a5b9d9d1bd23d2d57

Download Submit
\Windows\SysWOW64\ocujipjx.exe

Filesize
255KB

MD5
00118f5a3d1c7bc4f1e614246ea610c1

SHA1
5bad0a82554c1467d451e0477a85e4cbb3958277

SHA256
56f1ba6fd2d470169e4327db241f94304ba042265534c9cddbab60ad84f5acbb

SHA512
b60fe7c1f639c038c293d06894860c26b42205f65cce69b78d1fcedcfb1efb4c6def00640443dfe488aa3a1c808ba2929f977a73cfffad25ebcd021e9528da8d

Download Submit
\Windows\SysWOW64\ocujipjx.exe

Filesize
255KB

MD5
00118f5a3d1c7bc4f1e614246ea610c1

SHA1
5bad0a82554c1467d451e0477a85e4cbb3958277

SHA256
56f1ba6fd2d470169e4327db241f94304ba042265534c9cddbab60ad84f5acbb

SHA512
b60fe7c1f639c038c293d06894860c26b42205f65cce69b78d1fcedcfb1efb4c6def00640443dfe488aa3a1c808ba2929f977a73cfffad25ebcd021e9528da8d

Download Submit
\Windows\SysWOW64\ugdszvgprvzkf.exe

Filesize
255KB

MD5
49f0fd66f78d0ddf0f2057599ab5130d

SHA1
c38c0ce8ae5697853268c0c791dc789c65ad5a41

SHA256
824e8d3ef9bcc8ecb7c7c921fa347099b8b2fccc6b521db2597d9ac0700ab142

SHA512
79a6d38e5e841edca743df2a85d64b86ec571ec8678c63ccc4420e2c9cc5aae25aec40be5514f8f5f3240456e923f8333d0255e8b6c2d6efc8c626fb6a60713c

Download Submit
\Windows\SysWOW64\ugdszvgprvzkf.exe

Filesize
255KB

MD5
49f0fd66f78d0ddf0f2057599ab5130d

SHA1
c38c0ce8ae5697853268c0c791dc789c65ad5a41

SHA256
824e8d3ef9bcc8ecb7c7c921fa347099b8b2fccc6b521db2597d9ac0700ab142

SHA512
79a6d38e5e841edca743df2a85d64b86ec571ec8678c63ccc4420e2c9cc5aae25aec40be5514f8f5f3240456e923f8333d0255e8b6c2d6efc8c626fb6a60713c

Download Submit
\Windows\SysWOW64\zweiovofflsitzx.exe

Filesize
255KB

MD5
372ce737f63fe9bb5125fa9a2c2b474a

SHA1
b608e899b48ac3cd10ba47b632cb894330819fe9

SHA256
fc31737d4583883747eaf659469e8776516be3c4469993cd20123492ceda2e0d

SHA512
65ce2c0edac419dfa42d432a006599453381e8167af21a945f6b9a43fa50edb6badb0f1c0f35552ad8c843b47e8aefd2cf083c38e90ebdb033d9915ec13450ff

Download Submit
memory/332-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/332-108-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/580-107-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/580-117-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/580-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/584-88-0x0000000000260000-0x0000000000300000-memory.dmp

Filesize
640KB

Download
memory/588-113-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/840-98-0x0000000003870000-0x0000000003910000-memory.dmp

Filesize
640KB

Download
memory/840-105-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/840-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/860-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/860-86-0x0000000002F30000-0x0000000002FD0000-memory.dmp

Filesize
640KB

Download
memory/860-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/860-84-0x0000000002F30000-0x0000000002FD0000-memory.dmp

Filesize
640KB

Download
memory/860-81-0x0000000002F30000-0x0000000002FD0000-memory.dmp

Filesize
640KB

Download
memory/860-80-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/980-99-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/980-116-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/980-110-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1408-109-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1408-89-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1576-102-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

Filesize
44KB

Download
memory/1576-100-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1576-111-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

Filesize
44KB

Download
memory/1576-97-0x000000006FCB1000-0x000000006FCB3000-memory.dmp

Filesize
8KB

Download
memory/1576-96-0x0000000072231000-0x0000000072234000-memory.dmp

Filesize
12KB

Download
memory/1576-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1576-115-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

Filesize
44KB

Download
memory/1680-106-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1680-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download