Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
29c550be18671e1c38bf1726ec71da44.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
29c550be18671e1c38bf1726ec71da44.exe
Resource
win10v2004-20231215-en
General
-
Target
29c550be18671e1c38bf1726ec71da44.exe
-
Size
512KB
-
MD5
29c550be18671e1c38bf1726ec71da44
-
SHA1
7cf7e29d1e77b71eb45bf68c5254d8b14a228d64
-
SHA256
74cb279926b4e3b7d64b6bbcf88b7303650cdb4e84020f1275c9adfba67dcd48
-
SHA512
338a1dd60ca37722560d58f9e603a98a5b0ec8950ade3959e57c95d492b830fdda659ca1f1f9fe1f2504b0b9dbecfa3c47208dae82e6b5757119ac0b394007dd
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" sgzuedrcxq.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" sgzuedrcxq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sgzuedrcxq.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" sgzuedrcxq.exe -
Executes dropped EXE 5 IoCs
pid Process 2008 sgzuedrcxq.exe 3040 wblfkflwgrmnurv.exe 2256 vhocmvlf.exe 2660 jcbwkyramoyrs.exe 2668 vhocmvlf.exe -
Loads dropped DLL 5 IoCs
pid Process 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 2008 sgzuedrcxq.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sgzuedrcxq.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kjzwvvyi = "sgzuedrcxq.exe" wblfkflwgrmnurv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\nhuxppaf = "wblfkflwgrmnurv.exe" wblfkflwgrmnurv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "jcbwkyramoyrs.exe" wblfkflwgrmnurv.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\w: vhocmvlf.exe File opened (read-only) \??\s: vhocmvlf.exe File opened (read-only) \??\e: vhocmvlf.exe File opened (read-only) \??\v: vhocmvlf.exe File opened (read-only) \??\x: vhocmvlf.exe File opened (read-only) \??\v: vhocmvlf.exe File opened (read-only) \??\i: vhocmvlf.exe File opened (read-only) \??\p: vhocmvlf.exe File opened (read-only) \??\v: sgzuedrcxq.exe File opened (read-only) \??\n: vhocmvlf.exe File opened (read-only) \??\p: vhocmvlf.exe File opened (read-only) \??\n: vhocmvlf.exe File opened (read-only) \??\n: sgzuedrcxq.exe File opened (read-only) \??\y: sgzuedrcxq.exe File opened (read-only) \??\g: vhocmvlf.exe File opened (read-only) \??\a: sgzuedrcxq.exe File opened (read-only) \??\m: sgzuedrcxq.exe File opened (read-only) \??\z: vhocmvlf.exe File opened (read-only) \??\r: sgzuedrcxq.exe File opened (read-only) \??\k: vhocmvlf.exe File opened (read-only) \??\w: sgzuedrcxq.exe File opened (read-only) \??\z: sgzuedrcxq.exe File opened (read-only) \??\l: vhocmvlf.exe File opened (read-only) \??\u: vhocmvlf.exe File opened (read-only) \??\y: vhocmvlf.exe File opened (read-only) \??\b: sgzuedrcxq.exe File opened (read-only) \??\g: sgzuedrcxq.exe File opened (read-only) \??\s: vhocmvlf.exe File opened (read-only) \??\e: sgzuedrcxq.exe File opened (read-only) \??\y: vhocmvlf.exe File opened (read-only) \??\h: vhocmvlf.exe File opened (read-only) \??\l: vhocmvlf.exe File opened (read-only) \??\h: sgzuedrcxq.exe File opened (read-only) \??\p: sgzuedrcxq.exe File opened (read-only) \??\s: sgzuedrcxq.exe File opened (read-only) \??\r: vhocmvlf.exe File opened (read-only) \??\u: vhocmvlf.exe File opened (read-only) \??\h: vhocmvlf.exe File opened (read-only) \??\i: sgzuedrcxq.exe File opened (read-only) \??\j: sgzuedrcxq.exe File opened (read-only) \??\a: vhocmvlf.exe File opened (read-only) \??\b: vhocmvlf.exe File opened (read-only) \??\q: vhocmvlf.exe File opened (read-only) \??\t: vhocmvlf.exe File opened (read-only) \??\x: vhocmvlf.exe File opened (read-only) \??\t: sgzuedrcxq.exe File opened (read-only) \??\u: sgzuedrcxq.exe File opened (read-only) \??\l: sgzuedrcxq.exe File opened (read-only) \??\t: vhocmvlf.exe File opened (read-only) \??\k: sgzuedrcxq.exe File opened (read-only) \??\q: sgzuedrcxq.exe File opened (read-only) \??\e: vhocmvlf.exe File opened (read-only) \??\w: vhocmvlf.exe File opened (read-only) \??\m: vhocmvlf.exe File opened (read-only) \??\q: vhocmvlf.exe File opened (read-only) \??\o: sgzuedrcxq.exe File opened (read-only) \??\m: vhocmvlf.exe File opened (read-only) \??\o: vhocmvlf.exe File opened (read-only) \??\r: vhocmvlf.exe File opened (read-only) \??\b: vhocmvlf.exe File opened (read-only) \??\g: vhocmvlf.exe File opened (read-only) \??\z: vhocmvlf.exe File opened (read-only) \??\x: sgzuedrcxq.exe File opened (read-only) \??\k: vhocmvlf.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" sgzuedrcxq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" sgzuedrcxq.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/756-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000c0000000122f0-17.dat autoit_exe behavioral1/files/0x000b0000000149f5-25.dat autoit_exe behavioral1/files/0x000b0000000149f5-21.dat autoit_exe behavioral1/files/0x000c0000000122f0-20.dat autoit_exe behavioral1/files/0x000b0000000149f5-5.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\sgzuedrcxq.exe 29c550be18671e1c38bf1726ec71da44.exe File opened for modification C:\Windows\SysWOW64\sgzuedrcxq.exe 29c550be18671e1c38bf1726ec71da44.exe File created C:\Windows\SysWOW64\wblfkflwgrmnurv.exe 29c550be18671e1c38bf1726ec71da44.exe File created C:\Windows\SysWOW64\vhocmvlf.exe 29c550be18671e1c38bf1726ec71da44.exe File opened for modification C:\Windows\SysWOW64\vhocmvlf.exe 29c550be18671e1c38bf1726ec71da44.exe File created C:\Windows\SysWOW64\jcbwkyramoyrs.exe 29c550be18671e1c38bf1726ec71da44.exe File opened for modification C:\Windows\SysWOW64\jcbwkyramoyrs.exe 29c550be18671e1c38bf1726ec71da44.exe File opened for modification C:\Windows\SysWOW64\wblfkflwgrmnurv.exe 29c550be18671e1c38bf1726ec71da44.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll sgzuedrcxq.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vhocmvlf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vhocmvlf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal vhocmvlf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal vhocmvlf.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vhocmvlf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vhocmvlf.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vhocmvlf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal vhocmvlf.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vhocmvlf.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vhocmvlf.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe vhocmvlf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal vhocmvlf.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vhocmvlf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe vhocmvlf.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 29c550be18671e1c38bf1726ec71da44.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B15B47E1399A53BAB9D43299D7B9" 29c550be18671e1c38bf1726ec71da44.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32402C7F9D2382236A4276D477242CDD7C8665D8" 29c550be18671e1c38bf1726ec71da44.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 29c550be18671e1c38bf1726ec71da44.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" sgzuedrcxq.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc sgzuedrcxq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" sgzuedrcxq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg sgzuedrcxq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2684 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 2008 sgzuedrcxq.exe 2008 sgzuedrcxq.exe 2008 sgzuedrcxq.exe 2008 sgzuedrcxq.exe 2008 sgzuedrcxq.exe 2256 vhocmvlf.exe 2256 vhocmvlf.exe 2256 vhocmvlf.exe 2256 vhocmvlf.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 3040 wblfkflwgrmnurv.exe 3040 wblfkflwgrmnurv.exe 3040 wblfkflwgrmnurv.exe 3040 wblfkflwgrmnurv.exe 3040 wblfkflwgrmnurv.exe 2668 vhocmvlf.exe 2668 vhocmvlf.exe 2668 vhocmvlf.exe 2668 vhocmvlf.exe 3040 wblfkflwgrmnurv.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 3040 wblfkflwgrmnurv.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 3040 wblfkflwgrmnurv.exe 3040 wblfkflwgrmnurv.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 3040 wblfkflwgrmnurv.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 2008 sgzuedrcxq.exe 2008 sgzuedrcxq.exe 2008 sgzuedrcxq.exe 2256 vhocmvlf.exe 2256 vhocmvlf.exe 2256 vhocmvlf.exe 3040 wblfkflwgrmnurv.exe 3040 wblfkflwgrmnurv.exe 3040 wblfkflwgrmnurv.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 2668 vhocmvlf.exe 2668 vhocmvlf.exe 2668 vhocmvlf.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 756 29c550be18671e1c38bf1726ec71da44.exe 2008 sgzuedrcxq.exe 2008 sgzuedrcxq.exe 2008 sgzuedrcxq.exe 2256 vhocmvlf.exe 2256 vhocmvlf.exe 2256 vhocmvlf.exe 3040 wblfkflwgrmnurv.exe 3040 wblfkflwgrmnurv.exe 3040 wblfkflwgrmnurv.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 2660 jcbwkyramoyrs.exe 2668 vhocmvlf.exe 2668 vhocmvlf.exe 2668 vhocmvlf.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2684 WINWORD.EXE 2684 WINWORD.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 756 wrote to memory of 2008 756 29c550be18671e1c38bf1726ec71da44.exe 23 PID 756 wrote to memory of 2008 756 29c550be18671e1c38bf1726ec71da44.exe 23 PID 756 wrote to memory of 2008 756 29c550be18671e1c38bf1726ec71da44.exe 23 PID 756 wrote to memory of 2008 756 29c550be18671e1c38bf1726ec71da44.exe 23 PID 756 wrote to memory of 3040 756 29c550be18671e1c38bf1726ec71da44.exe 22 PID 756 wrote to memory of 3040 756 29c550be18671e1c38bf1726ec71da44.exe 22 PID 756 wrote to memory of 3040 756 29c550be18671e1c38bf1726ec71da44.exe 22 PID 756 wrote to memory of 3040 756 29c550be18671e1c38bf1726ec71da44.exe 22 PID 756 wrote to memory of 2256 756 29c550be18671e1c38bf1726ec71da44.exe 16 PID 756 wrote to memory of 2256 756 29c550be18671e1c38bf1726ec71da44.exe 16 PID 756 wrote to memory of 2256 756 29c550be18671e1c38bf1726ec71da44.exe 16 PID 756 wrote to memory of 2256 756 29c550be18671e1c38bf1726ec71da44.exe 16 PID 756 wrote to memory of 2660 756 29c550be18671e1c38bf1726ec71da44.exe 17 PID 756 wrote to memory of 2660 756 29c550be18671e1c38bf1726ec71da44.exe 17 PID 756 wrote to memory of 2660 756 29c550be18671e1c38bf1726ec71da44.exe 17 PID 756 wrote to memory of 2660 756 29c550be18671e1c38bf1726ec71da44.exe 17 PID 2008 wrote to memory of 2668 2008 sgzuedrcxq.exe 19 PID 2008 wrote to memory of 2668 2008 sgzuedrcxq.exe 19 PID 2008 wrote to memory of 2668 2008 sgzuedrcxq.exe 19 PID 2008 wrote to memory of 2668 2008 sgzuedrcxq.exe 19 PID 756 wrote to memory of 2684 756 29c550be18671e1c38bf1726ec71da44.exe 18 PID 756 wrote to memory of 2684 756 29c550be18671e1c38bf1726ec71da44.exe 18 PID 756 wrote to memory of 2684 756 29c550be18671e1c38bf1726ec71da44.exe 18 PID 756 wrote to memory of 2684 756 29c550be18671e1c38bf1726ec71da44.exe 18
Processes
-
C:\Windows\SysWOW64\vhocmvlf.exevhocmvlf.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2256
-
C:\Windows\SysWOW64\jcbwkyramoyrs.exejcbwkyramoyrs.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2660
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2684 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2836
-
-
C:\Windows\SysWOW64\vhocmvlf.exeC:\Windows\system32\vhocmvlf.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2668
-
C:\Windows\SysWOW64\wblfkflwgrmnurv.exewblfkflwgrmnurv.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3040
-
C:\Windows\SysWOW64\sgzuedrcxq.exesgzuedrcxq.exe1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008
-
C:\Users\Admin\AppData\Local\Temp\29c550be18671e1c38bf1726ec71da44.exe"C:\Users\Admin\AppData\Local\Temp\29c550be18671e1c38bf1726ec71da44.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:756
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD5bc53f71bc2d39dd0ef5c8e2e072309f7
SHA11ad8c6066f0bb4633db61f6812485bbcfc42918c
SHA256c3f399260296c4caf2eae3bc92f53bcd111d8d10c0eef342d19cbbe8cdd6ea28
SHA51287ae96162295c5735b9536c64374785fb3ce9e5805367544529a1412bc37495565e80dc3251be52c4330d3c8d1fb48ae708d19a338cbd14ef5d427f7ae4b6604
-
Filesize
388KB
MD53a9115612aa1839bbb6d2674d0c99867
SHA1a3f844c661a54c1ba35d22dbbad1fe046876348d
SHA2560e11bb4d1a76d4560196d809459c9e4c0b304deb73db83731e926c6e33e7f1ef
SHA5127aec9e96f49158465c53d24ffd19993e21ff06b9ecda6f9948d10a78c96a02e9848da84a8d291d20398fd9d47bb23b5ac35710d49837c168b596306280bae03d
-
Filesize
304KB
MD5c466be02a8b12c54773c4bf78d936b21
SHA1eb02e9b00e51526fc10d4c7a3165d1a60d4959af
SHA256e1b3bbf99ba00fdfda0a99331128750a9a1429604d158047730142f7bc69bce2
SHA512df33527fd2134a47c20752007e03d9f091e89c35c0dac18843cb6d853eed4b3de14d6c31ee2f61ad2d4ec1f17fe708ab88bce979e6b386ab82e9f7264a955794
-
Filesize
4KB
MD5ed1c60e9a7a92edcab339f7ee087e387
SHA188f8f6c911931da7e87f20ba56d19ccf2c015417
SHA256ef9e1d6f16e23f8640444b0070a2f899eef71f15354263a7d8fb43451b8810b3
SHA5122ecc0b336db1f9d6b3d4d6880980f27a8a4e9ce7eb25a12b095beb28075d793fc7667f06d7bc4512548393d0374885e8739514b96173aaefa44d7baf434f24a2