Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 21:05
Static task
static1
Behavioral task
behavioral1
Sample
1c74caeacf0bca43de75ba57e5f36032.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1c74caeacf0bca43de75ba57e5f36032.exe
Resource
win10v2004-20231215-en
General
-
Target
1c74caeacf0bca43de75ba57e5f36032.exe
-
Size
512KB
-
MD5
1c74caeacf0bca43de75ba57e5f36032
-
SHA1
85deaf42a1bf39f0c5d15c0988b89a42a3d37385
-
SHA256
8c3f0a9bb8fc55f0edddd22d8983fb66f712ba9e43c89126b54e1d752c5d8c3f
-
SHA512
b8fb038beacaa27a5ebb503491fdf299f094429e8284bd9c77bf337fd70297308181a30b9810661f2b07a8756f1ed7ec44f97a7a959f6edbbb414e46a2820300
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5k
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" rmbasvpvfy.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rmbasvpvfy.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rmbasvpvfy.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" rmbasvpvfy.exe -
Executes dropped EXE 5 IoCs
pid Process 1796 rmbasvpvfy.exe 2092 kkdkgfwfaaqnsbl.exe 2128 bnbilmiz.exe 2788 lgetnwxnxcqtr.exe 2660 bnbilmiz.exe -
Loads dropped DLL 5 IoCs
pid Process 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 1796 rmbasvpvfy.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rmbasvpvfy.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\myqdykvr = "kkdkgfwfaaqnsbl.exe" kkdkgfwfaaqnsbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "lgetnwxnxcqtr.exe" kkdkgfwfaaqnsbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\swzqpamm = "rmbasvpvfy.exe" kkdkgfwfaaqnsbl.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: bnbilmiz.exe File opened (read-only) \??\l: rmbasvpvfy.exe File opened (read-only) \??\q: bnbilmiz.exe File opened (read-only) \??\u: bnbilmiz.exe File opened (read-only) \??\n: bnbilmiz.exe File opened (read-only) \??\u: bnbilmiz.exe File opened (read-only) \??\j: bnbilmiz.exe File opened (read-only) \??\r: bnbilmiz.exe File opened (read-only) \??\s: bnbilmiz.exe File opened (read-only) \??\s: rmbasvpvfy.exe File opened (read-only) \??\y: rmbasvpvfy.exe File opened (read-only) \??\i: bnbilmiz.exe File opened (read-only) \??\v: bnbilmiz.exe File opened (read-only) \??\q: rmbasvpvfy.exe File opened (read-only) \??\t: rmbasvpvfy.exe File opened (read-only) \??\p: bnbilmiz.exe File opened (read-only) \??\s: bnbilmiz.exe File opened (read-only) \??\t: bnbilmiz.exe File opened (read-only) \??\u: rmbasvpvfy.exe File opened (read-only) \??\x: rmbasvpvfy.exe File opened (read-only) \??\k: bnbilmiz.exe File opened (read-only) \??\p: bnbilmiz.exe File opened (read-only) \??\w: bnbilmiz.exe File opened (read-only) \??\b: rmbasvpvfy.exe File opened (read-only) \??\v: rmbasvpvfy.exe File opened (read-only) \??\g: bnbilmiz.exe File opened (read-only) \??\h: bnbilmiz.exe File opened (read-only) \??\l: bnbilmiz.exe File opened (read-only) \??\q: bnbilmiz.exe File opened (read-only) \??\b: bnbilmiz.exe File opened (read-only) \??\g: rmbasvpvfy.exe File opened (read-only) \??\k: rmbasvpvfy.exe File opened (read-only) \??\l: bnbilmiz.exe File opened (read-only) \??\a: bnbilmiz.exe File opened (read-only) \??\o: bnbilmiz.exe File opened (read-only) \??\t: bnbilmiz.exe File opened (read-only) \??\z: bnbilmiz.exe File opened (read-only) \??\k: bnbilmiz.exe File opened (read-only) \??\w: bnbilmiz.exe File opened (read-only) \??\y: bnbilmiz.exe File opened (read-only) \??\z: bnbilmiz.exe File opened (read-only) \??\e: bnbilmiz.exe File opened (read-only) \??\x: bnbilmiz.exe File opened (read-only) \??\j: rmbasvpvfy.exe File opened (read-only) \??\n: rmbasvpvfy.exe File opened (read-only) \??\z: rmbasvpvfy.exe File opened (read-only) \??\h: bnbilmiz.exe File opened (read-only) \??\n: bnbilmiz.exe File opened (read-only) \??\x: bnbilmiz.exe File opened (read-only) \??\a: rmbasvpvfy.exe File opened (read-only) \??\e: bnbilmiz.exe File opened (read-only) \??\j: bnbilmiz.exe File opened (read-only) \??\p: rmbasvpvfy.exe File opened (read-only) \??\r: rmbasvpvfy.exe File opened (read-only) \??\a: bnbilmiz.exe File opened (read-only) \??\i: bnbilmiz.exe File opened (read-only) \??\m: bnbilmiz.exe File opened (read-only) \??\o: bnbilmiz.exe File opened (read-only) \??\m: bnbilmiz.exe File opened (read-only) \??\y: bnbilmiz.exe File opened (read-only) \??\h: rmbasvpvfy.exe File opened (read-only) \??\i: rmbasvpvfy.exe File opened (read-only) \??\o: rmbasvpvfy.exe File opened (read-only) \??\w: rmbasvpvfy.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" rmbasvpvfy.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" rmbasvpvfy.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2164-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000c000000013378-5.dat autoit_exe behavioral1/files/0x000d00000001224a-17.dat autoit_exe behavioral1/files/0x002a0000000165c9-29.dat autoit_exe behavioral1/files/0x0008000000016c05-34.dat autoit_exe behavioral1/files/0x0005000000019597-70.dat autoit_exe behavioral1/files/0x0005000000019599-76.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\kkdkgfwfaaqnsbl.exe 1c74caeacf0bca43de75ba57e5f36032.exe File opened for modification C:\Windows\SysWOW64\kkdkgfwfaaqnsbl.exe 1c74caeacf0bca43de75ba57e5f36032.exe File opened for modification C:\Windows\SysWOW64\bnbilmiz.exe 1c74caeacf0bca43de75ba57e5f36032.exe File opened for modification C:\Windows\SysWOW64\lgetnwxnxcqtr.exe 1c74caeacf0bca43de75ba57e5f36032.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll rmbasvpvfy.exe File created C:\Windows\SysWOW64\rmbasvpvfy.exe 1c74caeacf0bca43de75ba57e5f36032.exe File opened for modification C:\Windows\SysWOW64\rmbasvpvfy.exe 1c74caeacf0bca43de75ba57e5f36032.exe File created C:\Windows\SysWOW64\bnbilmiz.exe 1c74caeacf0bca43de75ba57e5f36032.exe File created C:\Windows\SysWOW64\lgetnwxnxcqtr.exe 1c74caeacf0bca43de75ba57e5f36032.exe -
Drops file in Program Files directory 18 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bnbilmiz.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bnbilmiz.exe File opened for modification C:\Program Files\BlockInvoke.nal bnbilmiz.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bnbilmiz.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bnbilmiz.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bnbilmiz.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal bnbilmiz.exe File created \??\c:\Program Files\BlockInvoke.doc.exe bnbilmiz.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bnbilmiz.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal bnbilmiz.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bnbilmiz.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe bnbilmiz.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal bnbilmiz.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal bnbilmiz.exe File opened for modification \??\c:\Program Files\BlockInvoke.doc.exe bnbilmiz.exe File opened for modification C:\Program Files\BlockInvoke.doc.exe bnbilmiz.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bnbilmiz.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe bnbilmiz.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 1c74caeacf0bca43de75ba57e5f36032.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFDFFFB485C826E9136D6207E9DBDE3E643594466466243D6ED" 1c74caeacf0bca43de75ba57e5f36032.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf rmbasvpvfy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" rmbasvpvfy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F268B2FF6E22D9D10BD0D68A749167" 1c74caeacf0bca43de75ba57e5f36032.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs rmbasvpvfy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 1c74caeacf0bca43de75ba57e5f36032.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B15D479739EB53B9BAA6329CD4CC" 1c74caeacf0bca43de75ba57e5f36032.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" rmbasvpvfy.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2724 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2092 kkdkgfwfaaqnsbl.exe 2092 kkdkgfwfaaqnsbl.exe 2092 kkdkgfwfaaqnsbl.exe 2092 kkdkgfwfaaqnsbl.exe 2092 kkdkgfwfaaqnsbl.exe 1796 rmbasvpvfy.exe 1796 rmbasvpvfy.exe 1796 rmbasvpvfy.exe 1796 rmbasvpvfy.exe 1796 rmbasvpvfy.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2128 bnbilmiz.exe 2128 bnbilmiz.exe 2128 bnbilmiz.exe 2128 bnbilmiz.exe 2092 kkdkgfwfaaqnsbl.exe 2660 bnbilmiz.exe 2660 bnbilmiz.exe 2660 bnbilmiz.exe 2660 bnbilmiz.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe 2092 kkdkgfwfaaqnsbl.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2092 kkdkgfwfaaqnsbl.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2092 kkdkgfwfaaqnsbl.exe 2092 kkdkgfwfaaqnsbl.exe 2092 kkdkgfwfaaqnsbl.exe 1796 rmbasvpvfy.exe 1796 rmbasvpvfy.exe 1796 rmbasvpvfy.exe 2128 bnbilmiz.exe 2128 bnbilmiz.exe 2128 bnbilmiz.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2660 bnbilmiz.exe 2660 bnbilmiz.exe 2660 bnbilmiz.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2164 1c74caeacf0bca43de75ba57e5f36032.exe 2092 kkdkgfwfaaqnsbl.exe 2092 kkdkgfwfaaqnsbl.exe 2092 kkdkgfwfaaqnsbl.exe 1796 rmbasvpvfy.exe 1796 rmbasvpvfy.exe 1796 rmbasvpvfy.exe 2128 bnbilmiz.exe 2128 bnbilmiz.exe 2128 bnbilmiz.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2788 lgetnwxnxcqtr.exe 2660 bnbilmiz.exe 2660 bnbilmiz.exe 2660 bnbilmiz.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2724 WINWORD.EXE 2724 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2164 wrote to memory of 1796 2164 1c74caeacf0bca43de75ba57e5f36032.exe 28 PID 2164 wrote to memory of 1796 2164 1c74caeacf0bca43de75ba57e5f36032.exe 28 PID 2164 wrote to memory of 1796 2164 1c74caeacf0bca43de75ba57e5f36032.exe 28 PID 2164 wrote to memory of 1796 2164 1c74caeacf0bca43de75ba57e5f36032.exe 28 PID 2164 wrote to memory of 2092 2164 1c74caeacf0bca43de75ba57e5f36032.exe 29 PID 2164 wrote to memory of 2092 2164 1c74caeacf0bca43de75ba57e5f36032.exe 29 PID 2164 wrote to memory of 2092 2164 1c74caeacf0bca43de75ba57e5f36032.exe 29 PID 2164 wrote to memory of 2092 2164 1c74caeacf0bca43de75ba57e5f36032.exe 29 PID 2164 wrote to memory of 2128 2164 1c74caeacf0bca43de75ba57e5f36032.exe 30 PID 2164 wrote to memory of 2128 2164 1c74caeacf0bca43de75ba57e5f36032.exe 30 PID 2164 wrote to memory of 2128 2164 1c74caeacf0bca43de75ba57e5f36032.exe 30 PID 2164 wrote to memory of 2128 2164 1c74caeacf0bca43de75ba57e5f36032.exe 30 PID 2164 wrote to memory of 2788 2164 1c74caeacf0bca43de75ba57e5f36032.exe 31 PID 2164 wrote to memory of 2788 2164 1c74caeacf0bca43de75ba57e5f36032.exe 31 PID 2164 wrote to memory of 2788 2164 1c74caeacf0bca43de75ba57e5f36032.exe 31 PID 2164 wrote to memory of 2788 2164 1c74caeacf0bca43de75ba57e5f36032.exe 31 PID 1796 wrote to memory of 2660 1796 rmbasvpvfy.exe 32 PID 1796 wrote to memory of 2660 1796 rmbasvpvfy.exe 32 PID 1796 wrote to memory of 2660 1796 rmbasvpvfy.exe 32 PID 1796 wrote to memory of 2660 1796 rmbasvpvfy.exe 32 PID 2164 wrote to memory of 2724 2164 1c74caeacf0bca43de75ba57e5f36032.exe 33 PID 2164 wrote to memory of 2724 2164 1c74caeacf0bca43de75ba57e5f36032.exe 33 PID 2164 wrote to memory of 2724 2164 1c74caeacf0bca43de75ba57e5f36032.exe 33 PID 2164 wrote to memory of 2724 2164 1c74caeacf0bca43de75ba57e5f36032.exe 33 PID 2724 wrote to memory of 1360 2724 WINWORD.EXE 36 PID 2724 wrote to memory of 1360 2724 WINWORD.EXE 36 PID 2724 wrote to memory of 1360 2724 WINWORD.EXE 36 PID 2724 wrote to memory of 1360 2724 WINWORD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c74caeacf0bca43de75ba57e5f36032.exe"C:\Users\Admin\AppData\Local\Temp\1c74caeacf0bca43de75ba57e5f36032.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\rmbasvpvfy.exermbasvpvfy.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\bnbilmiz.exeC:\Windows\system32\bnbilmiz.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2660
-
-
-
C:\Windows\SysWOW64\kkdkgfwfaaqnsbl.exekkdkgfwfaaqnsbl.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2092
-
-
C:\Windows\SysWOW64\bnbilmiz.exebnbilmiz.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2128
-
-
C:\Windows\SysWOW64\lgetnwxnxcqtr.exelgetnwxnxcqtr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2788
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1360
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5b9b03d7da8e6a8b771423715d1ab2404
SHA18ee8fcc1825b5bc6e12dda6b5cec884248822d1b
SHA256ed6580c76986fc54ce1fd5a20865202df6f765d0bc9e5409046197fd26374f9e
SHA512933ad50caf776c1779830836cbd9d5ca3247f20edfc3a2e1353321795cc41166deb6f5d6667f84c69bc2ae832abfaf9dedf4bee233beb50ee4840a785bc75586
-
Filesize
20KB
MD5b1248667c881fac824b025323fba3d00
SHA180a4ff1d82eeb2e30f748ea2376d7a7f32e81e52
SHA256dc1a7668cf766671190ba7c57e989b68c48732fd9e29d6fed6f80aac6ee3eb4e
SHA5122881f8df6697bd6a005b88e81cd79c897df1fe44401dbb8afbd2028c2ed74f45e3e55c4437090ad49e13d64ecbc40dabe37c07295a997ae53a18c231d0fbb1ff
-
Filesize
512KB
MD50172854ab2d6724e928394a6feea96e4
SHA1c02c65b7d613933bc36ae7ea51601ca388ba62a5
SHA2561c4965a90a3de3a9e269e58c131045641d624a432aff1f322058b18351f03ecf
SHA5120ad710e8a25ec86c218bf5a2babda92c58cbdc05b66b373d01edb971d406f54e0433011eaf3da7f4833b9541f893c6a12673aaf2885fdbaba18b0698ac8f4375
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5cc92ef9581b1ca7099e26864d87162f2
SHA1aa7c173e7dfaab617b8ecb88048de11bb3e38d6c
SHA256f81ca7bdd6f0d24a36f239afec53c5e35dc6b6c99dc4cfd6bf802b30e91576e3
SHA512602e3b3f854b475531b9e486df4436bc19795f7be7c595c403c9c32213a90ff050eb709b9508a7191acffdeebf09e13fa84b74b63be5b54bc57f9693bac78800
-
Filesize
512KB
MD553065bcce49ab03074f515952567c659
SHA1edd3b089dfc3f35005b25d8abfcf9bbcec2acc41
SHA2567d948f33a3a6692cb675414c2c269fe4f54ce6d17bc9c23577cec5d1e6d295d4
SHA512b75d811027b5beed4d34ea8344e290cb31dbed4d23c22b8dda269ddee99fe6b4a966843b3d4cda0679313a650f6dec7b661ac34cca90d4d984f4e39e68babe01
-
Filesize
512KB
MD55421135421b4bf6111a806e6b940e34f
SHA18a206d06af33b8dad93559006d5f955d6e063eaa
SHA256609e8acca8b9d119ac6184ac8c6645c420e14a47fea693a61ddf2f70b1cbcd2f
SHA5124da2d1c26374eb8e3b444a7162dfc00677940fe4508154c9edebac24f13ef28895771b01276c858d03a0419231e19d66226f15246d6d2db627fd99e3fa899580
-
Filesize
512KB
MD581ab4c93287b16363b65de01a230165f
SHA169a8db14f6d7eba224863537f0a961eea134eb18
SHA256e584869863bdfb22bcd5ff1450e210df1e33426325ced4841fb237f184bebba9
SHA512baa6f9f7fc2ffcd85334b5c92de2a033cefa5ab9ab07d7b5d0b6163bda7ea19df4af2fbc1eeb9262fec3138eb33ac746c4ee86b11e35a8d19b28452cb4dd6ef3