e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd

Analysis

max time kernel
151s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
Size

255KB
MD5

01fa4c3148bc49b004c17dbe534175ed
SHA1

9ee18d0cd1500271fb565c5f754ecce208574301
SHA256

e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd
SHA512

946678f10d14af7d857668bc9029545185f2ca13408b92e59b88ac07db68dfde868ceb8a443e9b9e40263d70f9d853383cd6c964593343c2b2c0b0f245b15a24
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJc:1xlZam+akqx6YQJXcNlEHUIQeE3mmBId

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	oaiiicttyg.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	oaiiicttyg.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	oaiiicttyg.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	oaiiicttyg.exe

Executes dropped EXE 5 IoCs

pid	Process
632	oaiiicttyg.exe
976	amofdrpaimqqeai.exe
852	zixiwrff.exe
1156	xyisjrbrvgrwz.exe
524	zixiwrff.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00140000000054ab-55.dat	upx
behavioral1/files/0x00140000000054ab-57.dat	upx
behavioral1/files/0x00090000000139f7-58.dat	upx
behavioral1/files/0x0007000000014142-62.dat	upx
behavioral1/files/0x00090000000139f7-61.dat	upx
behavioral1/files/0x00140000000054ab-64.dat	upx
behavioral1/files/0x0007000000014142-66.dat	upx
behavioral1/files/0x0006000000014151-68.dat	upx
behavioral1/files/0x0007000000014142-70.dat	upx
behavioral1/files/0x00090000000139f7-71.dat	upx
behavioral1/files/0x0006000000014151-72.dat	upx
behavioral1/files/0x0007000000014142-76.dat	upx
behavioral1/files/0x0007000000014142-74.dat	upx
behavioral1/files/0x0006000000014151-77.dat	upx
behavioral1/memory/880-79-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/632-81-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/976-82-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/852-83-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1156-84-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/524-85-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/880-87-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/632-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/852-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/976-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1156-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/524-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x00060000000146e3-100.dat	upx

Loads dropped DLL 5 IoCs

pid	Process
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
632	oaiiicttyg.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	oaiiicttyg.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	amofdrpaimqqeai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\feypveez = "oaiiicttyg.exe"	amofdrpaimqqeai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lbsfreia = "amofdrpaimqqeai.exe"	amofdrpaimqqeai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xyisjrbrvgrwz.exe"	amofdrpaimqqeai.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	zixiwrff.exe
File opened (read-only)	\??\v:	zixiwrff.exe
File opened (read-only)	\??\g:	oaiiicttyg.exe
File opened (read-only)	\??\j:	oaiiicttyg.exe
File opened (read-only)	\??\f:	zixiwrff.exe
File opened (read-only)	\??\z:	zixiwrff.exe
File opened (read-only)	\??\z:	zixiwrff.exe
File opened (read-only)	\??\l:	zixiwrff.exe
File opened (read-only)	\??\t:	oaiiicttyg.exe
File opened (read-only)	\??\y:	oaiiicttyg.exe
File opened (read-only)	\??\k:	zixiwrff.exe
File opened (read-only)	\??\a:	oaiiicttyg.exe
File opened (read-only)	\??\p:	oaiiicttyg.exe
File opened (read-only)	\??\b:	oaiiicttyg.exe
File opened (read-only)	\??\u:	oaiiicttyg.exe
File opened (read-only)	\??\y:	zixiwrff.exe
File opened (read-only)	\??\l:	zixiwrff.exe
File opened (read-only)	\??\q:	zixiwrff.exe
File opened (read-only)	\??\t:	zixiwrff.exe
File opened (read-only)	\??\f:	zixiwrff.exe
File opened (read-only)	\??\m:	zixiwrff.exe
File opened (read-only)	\??\r:	zixiwrff.exe
File opened (read-only)	\??\m:	oaiiicttyg.exe
File opened (read-only)	\??\o:	zixiwrff.exe
File opened (read-only)	\??\n:	zixiwrff.exe
File opened (read-only)	\??\v:	oaiiicttyg.exe
File opened (read-only)	\??\e:	zixiwrff.exe
File opened (read-only)	\??\k:	zixiwrff.exe
File opened (read-only)	\??\h:	zixiwrff.exe
File opened (read-only)	\??\x:	zixiwrff.exe
File opened (read-only)	\??\g:	zixiwrff.exe
File opened (read-only)	\??\o:	zixiwrff.exe
File opened (read-only)	\??\e:	oaiiicttyg.exe
File opened (read-only)	\??\h:	oaiiicttyg.exe
File opened (read-only)	\??\n:	oaiiicttyg.exe
File opened (read-only)	\??\a:	zixiwrff.exe
File opened (read-only)	\??\b:	zixiwrff.exe
File opened (read-only)	\??\g:	zixiwrff.exe
File opened (read-only)	\??\b:	zixiwrff.exe
File opened (read-only)	\??\e:	zixiwrff.exe
File opened (read-only)	\??\s:	zixiwrff.exe
File opened (read-only)	\??\s:	zixiwrff.exe
File opened (read-only)	\??\v:	zixiwrff.exe
File opened (read-only)	\??\f:	oaiiicttyg.exe
File opened (read-only)	\??\k:	oaiiicttyg.exe
File opened (read-only)	\??\l:	oaiiicttyg.exe
File opened (read-only)	\??\a:	zixiwrff.exe
File opened (read-only)	\??\j:	zixiwrff.exe
File opened (read-only)	\??\t:	zixiwrff.exe
File opened (read-only)	\??\u:	zixiwrff.exe
File opened (read-only)	\??\o:	oaiiicttyg.exe
File opened (read-only)	\??\r:	oaiiicttyg.exe
File opened (read-only)	\??\p:	zixiwrff.exe
File opened (read-only)	\??\x:	oaiiicttyg.exe
File opened (read-only)	\??\z:	oaiiicttyg.exe
File opened (read-only)	\??\j:	zixiwrff.exe
File opened (read-only)	\??\i:	zixiwrff.exe
File opened (read-only)	\??\u:	zixiwrff.exe
File opened (read-only)	\??\q:	oaiiicttyg.exe
File opened (read-only)	\??\i:	oaiiicttyg.exe
File opened (read-only)	\??\w:	oaiiicttyg.exe
File opened (read-only)	\??\r:	zixiwrff.exe
File opened (read-only)	\??\w:	zixiwrff.exe
File opened (read-only)	\??\h:	zixiwrff.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	oaiiicttyg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	oaiiicttyg.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/880-79-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/632-81-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/976-82-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/852-83-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1156-84-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/524-85-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/880-87-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/632-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/852-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/976-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1156-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/524-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xyisjrbrvgrwz.exe	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
File created	C:\Windows\SysWOW64\oaiiicttyg.exe	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
File opened for modification	C:\Windows\SysWOW64\oaiiicttyg.exe	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
File opened for modification	C:\Windows\SysWOW64\amofdrpaimqqeai.exe	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
File created	C:\Windows\SysWOW64\xyisjrbrvgrwz.exe	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	oaiiicttyg.exe
File created	C:\Windows\SysWOW64\amofdrpaimqqeai.exe	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
File created	C:\Windows\SysWOW64\zixiwrff.exe	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
File opened for modification	C:\Windows\SysWOW64\zixiwrff.exe	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	zixiwrff.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	zixiwrff.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	zixiwrff.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	zixiwrff.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	zixiwrff.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	zixiwrff.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	zixiwrff.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	zixiwrff.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	zixiwrff.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	zixiwrff.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	zixiwrff.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	zixiwrff.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	zixiwrff.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	zixiwrff.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	zixiwrff.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\~$mydoc.rtf	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F76BB0FF6D22D8D109D0D28A7C9060"	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	oaiiicttyg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	oaiiicttyg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184CC60814E1DAC4B9BD7CE1ED9734C8"	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	oaiiicttyg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	oaiiicttyg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF9FC8E482982129132D65A7D97BCEFE634594066456242D69E"	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	oaiiicttyg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1164	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
632	oaiiicttyg.exe
632	oaiiicttyg.exe
632	oaiiicttyg.exe
632	oaiiicttyg.exe
632	oaiiicttyg.exe
852	zixiwrff.exe
852	zixiwrff.exe
852	zixiwrff.exe
852	zixiwrff.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
524	zixiwrff.exe
524	zixiwrff.exe
524	zixiwrff.exe
524	zixiwrff.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
632	oaiiicttyg.exe
632	oaiiicttyg.exe
632	oaiiicttyg.exe
852	zixiwrff.exe
852	zixiwrff.exe
852	zixiwrff.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
524	zixiwrff.exe
524	zixiwrff.exe
524	zixiwrff.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
632	oaiiicttyg.exe
632	oaiiicttyg.exe
632	oaiiicttyg.exe
852	zixiwrff.exe
852	zixiwrff.exe
852	zixiwrff.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
976	amofdrpaimqqeai.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
1156	xyisjrbrvgrwz.exe
524	zixiwrff.exe
524	zixiwrff.exe
524	zixiwrff.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1164	WINWORD.EXE
1164	WINWORD.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 632	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	28
PID 880 wrote to memory of 632	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	28
PID 880 wrote to memory of 632	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	28
PID 880 wrote to memory of 632	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	28
PID 880 wrote to memory of 976	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	29
PID 880 wrote to memory of 976	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	29
PID 880 wrote to memory of 976	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	29
PID 880 wrote to memory of 976	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	29
PID 880 wrote to memory of 852	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	30
PID 880 wrote to memory of 852	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	30
PID 880 wrote to memory of 852	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	30
PID 880 wrote to memory of 852	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	30
PID 880 wrote to memory of 1156	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	31
PID 880 wrote to memory of 1156	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	31
PID 880 wrote to memory of 1156	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	31
PID 880 wrote to memory of 1156	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	31
PID 632 wrote to memory of 524	632	oaiiicttyg.exe	32
PID 632 wrote to memory of 524	632	oaiiicttyg.exe	32
PID 632 wrote to memory of 524	632	oaiiicttyg.exe	32
PID 632 wrote to memory of 524	632	oaiiicttyg.exe	32
PID 880 wrote to memory of 1164	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	33
PID 880 wrote to memory of 1164	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	33
PID 880 wrote to memory of 1164	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	33
PID 880 wrote to memory of 1164	880	e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe	33
PID 1164 wrote to memory of 860	1164	WINWORD.EXE	37
PID 1164 wrote to memory of 860	1164	WINWORD.EXE	37
PID 1164 wrote to memory of 860	1164	WINWORD.EXE	37
PID 1164 wrote to memory of 860	1164	WINWORD.EXE	37

C:\Users\Admin\AppData\Local\Temp\e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe
"C:\Users\Admin\AppData\Local\Temp\e538fce47785290633c5aeddb544c4a2317d258ad370c21779d0cebb36711dfd.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\oaiiicttyg.exe
  oaiiicttyg.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\zixiwrff.exe
    C:\Windows\system32\zixiwrff.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:524
- C:\Windows\SysWOW64\amofdrpaimqqeai.exe
  amofdrpaimqqeai.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:976
- C:\Windows\SysWOW64\zixiwrff.exe
  zixiwrff.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:852
- C:\Windows\SysWOW64\xyisjrbrvgrwz.exe
  xyisjrbrvgrwz.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1156
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
017fe2998a45219107ca59faee1201c4

SHA1
26bc98d611b47a5f8a2db7649fa5ec1efc3a4078

SHA256
64a214fa4c06ace7eda057703a7a35b9b211143c1557599bdbd1a65c9210ca4f

SHA512
92ffc797a1f8b66ff95b5650c83f105f8d59ab5e751ca7f4a5bdb32c944be1c933ef6308984d7ffc4921d2b803a4d2266a2b69fcb458fc0dcd474bd544a26455

Download Submit
C:\Windows\SysWOW64\amofdrpaimqqeai.exe

Filesize
255KB

MD5
fd999494bb8a6316b6d9310b1baac3a6

SHA1
3ef540e28c092edc0019612c0740717fa03645d9

SHA256
30d0e820dd31b2a2fde876571834deb5d530fc58f6d08fbfbb3156a0f67a16f0

SHA512
3cc3791b5b2627b5ff2955c37cd377167fd92f4e1c6403a9ba35274a6467644c62d8465031515d5048c126e42d7e05ab369345d5587a915a71c6e0c94505c30a

Download Submit
C:\Windows\SysWOW64\amofdrpaimqqeai.exe

Filesize
255KB

MD5
fd999494bb8a6316b6d9310b1baac3a6

SHA1
3ef540e28c092edc0019612c0740717fa03645d9

SHA256
30d0e820dd31b2a2fde876571834deb5d530fc58f6d08fbfbb3156a0f67a16f0

SHA512
3cc3791b5b2627b5ff2955c37cd377167fd92f4e1c6403a9ba35274a6467644c62d8465031515d5048c126e42d7e05ab369345d5587a915a71c6e0c94505c30a

Download Submit
C:\Windows\SysWOW64\oaiiicttyg.exe

Filesize
255KB

MD5
b0f117fd713151ea499c3225c4786435

SHA1
c20a88291178f3854127f6cb43bc26f7fad8a671

SHA256
7d1b4ae0bb3da318ddd94d43da5e86332e3a2ec1a29fd3882e4d254289fceda7

SHA512
e9224b508c1120affd453fb34aa4c609d9cc6eaaf1fbe17d4ab923fc2094853be83a71734fd839a1276498aee48f38458d549d8ba6cdcbc3e423d3518f8afccc

Download Submit
C:\Windows\SysWOW64\oaiiicttyg.exe

Filesize
255KB

MD5
b0f117fd713151ea499c3225c4786435

SHA1
c20a88291178f3854127f6cb43bc26f7fad8a671

SHA256
7d1b4ae0bb3da318ddd94d43da5e86332e3a2ec1a29fd3882e4d254289fceda7

SHA512
e9224b508c1120affd453fb34aa4c609d9cc6eaaf1fbe17d4ab923fc2094853be83a71734fd839a1276498aee48f38458d549d8ba6cdcbc3e423d3518f8afccc

Download Submit
C:\Windows\SysWOW64\xyisjrbrvgrwz.exe

Filesize
255KB

MD5
46e1407ad02c74f0a4bfbead95542667

SHA1
6042e4f75413af0f3c50fe88d1f9a7afd242617a

SHA256
351dc2c719e63820c5a75d1d7f5c8fa5e63b266e0d94cb7bed0fd65080a5baa3

SHA512
e5c2cec926e328384e6f5c6fcc61ec66b62ea76ed4204de034e52b4fd90ec8b2e3f576449251f1613c561608ae2828fb78f152fb5795b7a97e81b38f64c2c9ab

Download Submit
C:\Windows\SysWOW64\xyisjrbrvgrwz.exe

Filesize
255KB

MD5
46e1407ad02c74f0a4bfbead95542667

SHA1
6042e4f75413af0f3c50fe88d1f9a7afd242617a

SHA256
351dc2c719e63820c5a75d1d7f5c8fa5e63b266e0d94cb7bed0fd65080a5baa3

SHA512
e5c2cec926e328384e6f5c6fcc61ec66b62ea76ed4204de034e52b4fd90ec8b2e3f576449251f1613c561608ae2828fb78f152fb5795b7a97e81b38f64c2c9ab

Download Submit
C:\Windows\SysWOW64\zixiwrff.exe

Filesize
255KB

MD5
be8c49b256d6c615385924493c0c84ae

SHA1
cf1b5d090b7e29ed5c289f9ac60cb3e2df47b542

SHA256
60fd0c206635fcca2baa45f8abda622d89f9ed41af1b24d3e9c8506fbfd28615

SHA512
382c19b6085ac4f4734711b822fb073472f397c7bf370f89b9c366750a31366f87389c8407125740acc92d545975cf4c390c85d67c6d9a12335812e0a9af89d4

Download Submit
C:\Windows\SysWOW64\zixiwrff.exe

Filesize
255KB

MD5
be8c49b256d6c615385924493c0c84ae

SHA1
cf1b5d090b7e29ed5c289f9ac60cb3e2df47b542

SHA256
60fd0c206635fcca2baa45f8abda622d89f9ed41af1b24d3e9c8506fbfd28615

SHA512
382c19b6085ac4f4734711b822fb073472f397c7bf370f89b9c366750a31366f87389c8407125740acc92d545975cf4c390c85d67c6d9a12335812e0a9af89d4

Download Submit
C:\Windows\SysWOW64\zixiwrff.exe

Filesize
255KB

MD5
be8c49b256d6c615385924493c0c84ae

SHA1
cf1b5d090b7e29ed5c289f9ac60cb3e2df47b542

SHA256
60fd0c206635fcca2baa45f8abda622d89f9ed41af1b24d3e9c8506fbfd28615

SHA512
382c19b6085ac4f4734711b822fb073472f397c7bf370f89b9c366750a31366f87389c8407125740acc92d545975cf4c390c85d67c6d9a12335812e0a9af89d4

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\amofdrpaimqqeai.exe

Filesize
255KB

MD5
fd999494bb8a6316b6d9310b1baac3a6

SHA1
3ef540e28c092edc0019612c0740717fa03645d9

SHA256
30d0e820dd31b2a2fde876571834deb5d530fc58f6d08fbfbb3156a0f67a16f0

SHA512
3cc3791b5b2627b5ff2955c37cd377167fd92f4e1c6403a9ba35274a6467644c62d8465031515d5048c126e42d7e05ab369345d5587a915a71c6e0c94505c30a

Download Submit
\Windows\SysWOW64\oaiiicttyg.exe

Filesize
255KB

MD5
b0f117fd713151ea499c3225c4786435

SHA1
c20a88291178f3854127f6cb43bc26f7fad8a671

SHA256
7d1b4ae0bb3da318ddd94d43da5e86332e3a2ec1a29fd3882e4d254289fceda7

SHA512
e9224b508c1120affd453fb34aa4c609d9cc6eaaf1fbe17d4ab923fc2094853be83a71734fd839a1276498aee48f38458d549d8ba6cdcbc3e423d3518f8afccc

Download Submit
\Windows\SysWOW64\xyisjrbrvgrwz.exe

Filesize
255KB

MD5
46e1407ad02c74f0a4bfbead95542667

SHA1
6042e4f75413af0f3c50fe88d1f9a7afd242617a

SHA256
351dc2c719e63820c5a75d1d7f5c8fa5e63b266e0d94cb7bed0fd65080a5baa3

SHA512
e5c2cec926e328384e6f5c6fcc61ec66b62ea76ed4204de034e52b4fd90ec8b2e3f576449251f1613c561608ae2828fb78f152fb5795b7a97e81b38f64c2c9ab

Download Submit
\Windows\SysWOW64\zixiwrff.exe

Filesize
255KB

MD5
be8c49b256d6c615385924493c0c84ae

SHA1
cf1b5d090b7e29ed5c289f9ac60cb3e2df47b542

SHA256
60fd0c206635fcca2baa45f8abda622d89f9ed41af1b24d3e9c8506fbfd28615

SHA512
382c19b6085ac4f4734711b822fb073472f397c7bf370f89b9c366750a31366f87389c8407125740acc92d545975cf4c390c85d67c6d9a12335812e0a9af89d4

Download Submit
\Windows\SysWOW64\zixiwrff.exe

Filesize
255KB

MD5
be8c49b256d6c615385924493c0c84ae

SHA1
cf1b5d090b7e29ed5c289f9ac60cb3e2df47b542

SHA256
60fd0c206635fcca2baa45f8abda622d89f9ed41af1b24d3e9c8506fbfd28615

SHA512
382c19b6085ac4f4734711b822fb073472f397c7bf370f89b9c366750a31366f87389c8407125740acc92d545975cf4c390c85d67c6d9a12335812e0a9af89d4

Download Submit
memory/524-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/524-85-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/632-81-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/632-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/852-83-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/852-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/860-102-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

Filesize
8KB

Download
memory/880-80-0x00000000032C0000-0x0000000003360000-memory.dmp

Filesize
640KB

Download
memory/880-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/880-79-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/880-87-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/976-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/976-82-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1156-84-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1156-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1164-92-0x000000007170D000-0x0000000071718000-memory.dmp

Filesize
44KB

Download
memory/1164-99-0x000000007170D000-0x0000000071718000-memory.dmp

Filesize
44KB

Download
memory/1164-90-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1164-89-0x0000000070721000-0x0000000070723000-memory.dmp

Filesize
8KB

Download
memory/1164-88-0x0000000072CA1000-0x0000000072CA4000-memory.dmp

Filesize
12KB

Download
memory/1164-103-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1164-104-0x000000007170D000-0x0000000071718000-memory.dmp

Filesize
44KB

Download