Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
05906c39cad698da162ccf37f3964228.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
05906c39cad698da162ccf37f3964228.exe
Resource
win10v2004-20231215-en
General
-
Target
05906c39cad698da162ccf37f3964228.exe
-
Size
512KB
-
MD5
05906c39cad698da162ccf37f3964228
-
SHA1
0cf0214a3cb6a32e5bc139d6dcff6b7cbb2bcd88
-
SHA256
e1d59c5b329a280bc03ddc31f57e993eb14fb4afa7d80c4feb7b99c787699065
-
SHA512
3654a9d697e49d2c245d6dd82c49e5e5db9eedb347e7349d443e9a2247115a15fc27294f3def10a83a71a241fc4266e50d84b4d6633eb5304e139c3b9869c26b
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" dhvrzutael.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dhvrzutael.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" dhvrzutael.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dhvrzutael.exe -
Executes dropped EXE 5 IoCs
pid Process 2664 dhvrzutael.exe 2760 ckhiffuzygisdhc.exe 2396 vtegwyxd.exe 2712 tkukfoxdyctcs.exe 2704 vtegwyxd.exe -
Loads dropped DLL 5 IoCs
pid Process 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2664 dhvrzutael.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dhvrzutael.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uefddklf = "dhvrzutael.exe" ckhiffuzygisdhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qgbzuwfz = "ckhiffuzygisdhc.exe" ckhiffuzygisdhc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tkukfoxdyctcs.exe" ckhiffuzygisdhc.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: dhvrzutael.exe File opened (read-only) \??\w: dhvrzutael.exe File opened (read-only) \??\p: vtegwyxd.exe File opened (read-only) \??\l: dhvrzutael.exe File opened (read-only) \??\q: dhvrzutael.exe File opened (read-only) \??\i: vtegwyxd.exe File opened (read-only) \??\p: vtegwyxd.exe File opened (read-only) \??\e: vtegwyxd.exe File opened (read-only) \??\b: vtegwyxd.exe File opened (read-only) \??\e: vtegwyxd.exe File opened (read-only) \??\j: vtegwyxd.exe File opened (read-only) \??\z: dhvrzutael.exe File opened (read-only) \??\l: vtegwyxd.exe File opened (read-only) \??\j: vtegwyxd.exe File opened (read-only) \??\r: vtegwyxd.exe File opened (read-only) \??\g: vtegwyxd.exe File opened (read-only) \??\y: vtegwyxd.exe File opened (read-only) \??\k: vtegwyxd.exe File opened (read-only) \??\a: dhvrzutael.exe File opened (read-only) \??\u: dhvrzutael.exe File opened (read-only) \??\k: vtegwyxd.exe File opened (read-only) \??\z: vtegwyxd.exe File opened (read-only) \??\u: vtegwyxd.exe File opened (read-only) \??\e: dhvrzutael.exe File opened (read-only) \??\v: dhvrzutael.exe File opened (read-only) \??\g: vtegwyxd.exe File opened (read-only) \??\g: dhvrzutael.exe File opened (read-only) \??\n: dhvrzutael.exe File opened (read-only) \??\t: dhvrzutael.exe File opened (read-only) \??\s: vtegwyxd.exe File opened (read-only) \??\m: vtegwyxd.exe File opened (read-only) \??\k: dhvrzutael.exe File opened (read-only) \??\p: dhvrzutael.exe File opened (read-only) \??\r: vtegwyxd.exe File opened (read-only) \??\a: vtegwyxd.exe File opened (read-only) \??\x: vtegwyxd.exe File opened (read-only) \??\z: vtegwyxd.exe File opened (read-only) \??\o: vtegwyxd.exe File opened (read-only) \??\w: vtegwyxd.exe File opened (read-only) \??\x: vtegwyxd.exe File opened (read-only) \??\b: dhvrzutael.exe File opened (read-only) \??\h: dhvrzutael.exe File opened (read-only) \??\r: dhvrzutael.exe File opened (read-only) \??\n: vtegwyxd.exe File opened (read-only) \??\s: vtegwyxd.exe File opened (read-only) \??\h: vtegwyxd.exe File opened (read-only) \??\u: vtegwyxd.exe File opened (read-only) \??\i: dhvrzutael.exe File opened (read-only) \??\y: dhvrzutael.exe File opened (read-only) \??\a: vtegwyxd.exe File opened (read-only) \??\l: vtegwyxd.exe File opened (read-only) \??\v: vtegwyxd.exe File opened (read-only) \??\x: dhvrzutael.exe File opened (read-only) \??\o: vtegwyxd.exe File opened (read-only) \??\j: dhvrzutael.exe File opened (read-only) \??\i: vtegwyxd.exe File opened (read-only) \??\n: vtegwyxd.exe File opened (read-only) \??\q: vtegwyxd.exe File opened (read-only) \??\m: dhvrzutael.exe File opened (read-only) \??\b: vtegwyxd.exe File opened (read-only) \??\y: vtegwyxd.exe File opened (read-only) \??\s: dhvrzutael.exe File opened (read-only) \??\h: vtegwyxd.exe File opened (read-only) \??\m: vtegwyxd.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" dhvrzutael.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" dhvrzutael.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2000-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000f00000001529f-5.dat autoit_exe behavioral1/files/0x000a000000012251-17.dat autoit_exe behavioral1/files/0x00080000000155ea-28.dat autoit_exe behavioral1/files/0x0007000000015610-35.dat autoit_exe behavioral1/files/0x0006000000018a8f-73.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ckhiffuzygisdhc.exe 05906c39cad698da162ccf37f3964228.exe File opened for modification C:\Windows\SysWOW64\ckhiffuzygisdhc.exe 05906c39cad698da162ccf37f3964228.exe File created C:\Windows\SysWOW64\vtegwyxd.exe 05906c39cad698da162ccf37f3964228.exe File opened for modification C:\Windows\SysWOW64\vtegwyxd.exe 05906c39cad698da162ccf37f3964228.exe File created C:\Windows\SysWOW64\tkukfoxdyctcs.exe 05906c39cad698da162ccf37f3964228.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll dhvrzutael.exe File created C:\Windows\SysWOW64\dhvrzutael.exe 05906c39cad698da162ccf37f3964228.exe File opened for modification C:\Windows\SysWOW64\dhvrzutael.exe 05906c39cad698da162ccf37f3964228.exe File opened for modification C:\Windows\SysWOW64\tkukfoxdyctcs.exe 05906c39cad698da162ccf37f3964228.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vtegwyxd.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vtegwyxd.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vtegwyxd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal vtegwyxd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal vtegwyxd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal vtegwyxd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vtegwyxd.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vtegwyxd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vtegwyxd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vtegwyxd.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vtegwyxd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vtegwyxd.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal vtegwyxd.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vtegwyxd.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 05906c39cad698da162ccf37f3964228.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ACDFABFF965F190830F3B47819E3EE2B3FD02884361023AE1CA42E808A9" 05906c39cad698da162ccf37f3964228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" dhvrzutael.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" dhvrzutael.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc dhvrzutael.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 05906c39cad698da162ccf37f3964228.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1938C60F15E0DBB1B9C17FE3EDE337BC" 05906c39cad698da162ccf37f3964228.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf dhvrzutael.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg dhvrzutael.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2528 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2664 dhvrzutael.exe 2664 dhvrzutael.exe 2664 dhvrzutael.exe 2664 dhvrzutael.exe 2664 dhvrzutael.exe 2000 05906c39cad698da162ccf37f3964228.exe 2396 vtegwyxd.exe 2396 vtegwyxd.exe 2396 vtegwyxd.exe 2396 vtegwyxd.exe 2760 ckhiffuzygisdhc.exe 2760 ckhiffuzygisdhc.exe 2760 ckhiffuzygisdhc.exe 2760 ckhiffuzygisdhc.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2704 vtegwyxd.exe 2704 vtegwyxd.exe 2704 vtegwyxd.exe 2704 vtegwyxd.exe 2760 ckhiffuzygisdhc.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2760 ckhiffuzygisdhc.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2664 dhvrzutael.exe 2664 dhvrzutael.exe 2664 dhvrzutael.exe 2396 vtegwyxd.exe 2396 vtegwyxd.exe 2396 vtegwyxd.exe 2760 ckhiffuzygisdhc.exe 2760 ckhiffuzygisdhc.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2704 vtegwyxd.exe 2704 vtegwyxd.exe 2704 vtegwyxd.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2000 05906c39cad698da162ccf37f3964228.exe 2664 dhvrzutael.exe 2664 dhvrzutael.exe 2664 dhvrzutael.exe 2396 vtegwyxd.exe 2396 vtegwyxd.exe 2396 vtegwyxd.exe 2760 ckhiffuzygisdhc.exe 2760 ckhiffuzygisdhc.exe 2760 ckhiffuzygisdhc.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2712 tkukfoxdyctcs.exe 2704 vtegwyxd.exe 2704 vtegwyxd.exe 2704 vtegwyxd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2528 WINWORD.EXE 2528 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2664 2000 05906c39cad698da162ccf37f3964228.exe 28 PID 2000 wrote to memory of 2664 2000 05906c39cad698da162ccf37f3964228.exe 28 PID 2000 wrote to memory of 2664 2000 05906c39cad698da162ccf37f3964228.exe 28 PID 2000 wrote to memory of 2664 2000 05906c39cad698da162ccf37f3964228.exe 28 PID 2000 wrote to memory of 2760 2000 05906c39cad698da162ccf37f3964228.exe 29 PID 2000 wrote to memory of 2760 2000 05906c39cad698da162ccf37f3964228.exe 29 PID 2000 wrote to memory of 2760 2000 05906c39cad698da162ccf37f3964228.exe 29 PID 2000 wrote to memory of 2760 2000 05906c39cad698da162ccf37f3964228.exe 29 PID 2000 wrote to memory of 2396 2000 05906c39cad698da162ccf37f3964228.exe 30 PID 2000 wrote to memory of 2396 2000 05906c39cad698da162ccf37f3964228.exe 30 PID 2000 wrote to memory of 2396 2000 05906c39cad698da162ccf37f3964228.exe 30 PID 2000 wrote to memory of 2396 2000 05906c39cad698da162ccf37f3964228.exe 30 PID 2000 wrote to memory of 2712 2000 05906c39cad698da162ccf37f3964228.exe 31 PID 2000 wrote to memory of 2712 2000 05906c39cad698da162ccf37f3964228.exe 31 PID 2000 wrote to memory of 2712 2000 05906c39cad698da162ccf37f3964228.exe 31 PID 2000 wrote to memory of 2712 2000 05906c39cad698da162ccf37f3964228.exe 31 PID 2664 wrote to memory of 2704 2664 dhvrzutael.exe 32 PID 2664 wrote to memory of 2704 2664 dhvrzutael.exe 32 PID 2664 wrote to memory of 2704 2664 dhvrzutael.exe 32 PID 2664 wrote to memory of 2704 2664 dhvrzutael.exe 32 PID 2000 wrote to memory of 2528 2000 05906c39cad698da162ccf37f3964228.exe 33 PID 2000 wrote to memory of 2528 2000 05906c39cad698da162ccf37f3964228.exe 33 PID 2000 wrote to memory of 2528 2000 05906c39cad698da162ccf37f3964228.exe 33 PID 2000 wrote to memory of 2528 2000 05906c39cad698da162ccf37f3964228.exe 33 PID 2528 wrote to memory of 1972 2528 WINWORD.EXE 36 PID 2528 wrote to memory of 1972 2528 WINWORD.EXE 36 PID 2528 wrote to memory of 1972 2528 WINWORD.EXE 36 PID 2528 wrote to memory of 1972 2528 WINWORD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\05906c39cad698da162ccf37f3964228.exe"C:\Users\Admin\AppData\Local\Temp\05906c39cad698da162ccf37f3964228.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\dhvrzutael.exedhvrzutael.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\vtegwyxd.exeC:\Windows\system32\vtegwyxd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2704
-
-
-
C:\Windows\SysWOW64\ckhiffuzygisdhc.execkhiffuzygisdhc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760
-
-
C:\Windows\SysWOW64\vtegwyxd.exevtegwyxd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2396
-
-
C:\Windows\SysWOW64\tkukfoxdyctcs.exetkukfoxdyctcs.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2712
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1972
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD53fd4f16f7257c86bed086ab7827d0982
SHA17474408e550ffeb87875d026758660188f40b020
SHA256e1f6bf334688724d0b5c6dde87e984cbea305777211b57f2122f432f1a8347c1
SHA512fb8b5cfd22ed59ff06da9f4be7929e09d837b1c3037c0c7e76850d460c9e88c5bed2c6b64367125d135da70a7f90e8f9db177cf16fd44754790368734583ee05
-
Filesize
20KB
MD582ae36eb00d4118fa59f134f3b7eb74b
SHA1a3450e7b02d92a927360bd463651aab27243719e
SHA256212d1e21ec45e617cf42290d7565b6177e7bf73ad97cddc1b6d1b5a856ba5237
SHA51206100e526ce8010c2622b2e0d323402babc1ffddde6a1dde7db7fe3d3f9f666c5aa28d5612ee0335c9f66a366989715443791c2d15a1d262e482657753d94eaa
-
Filesize
512KB
MD5ddd76f04435c04652a265dffd175588e
SHA1f5fb330b4cbe1a197b9747d16c22c5e74e62e9db
SHA2560c13c21f53868edcb5cfe196ce1efdb306fa8ac6a0d0a74be57858228c1660f4
SHA512329d0a77b43d512ec4cde18dcae3b26973b04abe35fc04d99a524b57fd9800f4fec41b2311f8bd82da9c27ff5f3deaf68e7c1eead6d6de081e059c6a6b7d8a9c
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5d6969d1de3e3f4777b5327d01ef3eae6
SHA1a28da7ace97fb5e3e75ee7c124e8705c4bcaa320
SHA2569c3d88f667bb401833f39df3d2e9a91590c8d024c2173409c23b88cf6140246b
SHA51209c6d3771d4eca7da8bd55503672c52303c8e2fb216a3609aa60a24a4dfd2a8f756a05ec998b4d5cf1cd5f951e1cdd0cd2bca070f8c45c0d56d1025d0a743052
-
Filesize
512KB
MD53182d282e2b5f3300c7173aae93a99df
SHA102ba8c51977cc667a14cfc7584a007c86b46081e
SHA2562397691f127ae364efd3b37f75101ed93f30d7b2c1b6c9f21807e3f3cf711195
SHA51282d1303df884089bbb35b9a50c0b57f6bf54b960d9b50f1a26a0efb15dd92619bb3272ce03710edf79d0fdac0751b7499d2ff77bf2d6a9901ea0fc1ff84c3d09
-
Filesize
512KB
MD5c35fa3e5d37c117c6293c3f553f58aeb
SHA131f504f932f8540bf17f75cbf39949301dc390a4
SHA25690a8fa326b062b1e5939adc109efd3761e72a2880df8bd5971989c03e0fabc8f
SHA512427c50e114c295a6e35555828411e31349b19f9a4d97e5a69b72beb3ad894ea299c10780c4adabc0072017add45eed476521a103383509b74b7c797c1090bc85