0c070654787fce6f1e05cc54c6a382bacbdb2b032ed07cf6ff39296bb4258476

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73e013693da5ed75f739f5bfe74ed2d9.exe
Size

512KB
MD5

73e013693da5ed75f739f5bfe74ed2d9
SHA1

f5dd4fdda13caaac465dd4060899dc9998d3c775
SHA256

0c070654787fce6f1e05cc54c6a382bacbdb2b032ed07cf6ff39296bb4258476
SHA512

e56ab96313aaf4bcc6dfef6c096e2f2c60bf037f3ce6a5469b3e8675287b3b1a144ec32a4dad7fe96e769b5568310b2bb997a25ee4f0eabfdc89f2c21e9b23e5
SSDEEP

6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R

Score

10^/10

evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	xjaczulxma.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	xjaczulxma.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	xjaczulxma.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xjaczulxma.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 5 IoCs

pid	Process
2892	xjaczulxma.exe
2140	snijszwnnjpacyp.exe
2780	vhpfwybt.exe
2828	iamjgzogbqlgk.exe
2896	vhpfwybt.exe

Loads dropped DLL 5 IoCs

pid	Process
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
2892	xjaczulxma.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	xjaczulxma.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\egpuqhxm = "xjaczulxma.exe"	snijszwnnjpacyp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uzporpwa = "snijszwnnjpacyp.exe"	snijszwnnjpacyp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "iamjgzogbqlgk.exe"	snijszwnnjpacyp.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	vhpfwybt.exe
File opened (read-only)	\??\j:	xjaczulxma.exe
File opened (read-only)	\??\x:	vhpfwybt.exe
File opened (read-only)	\??\h:	vhpfwybt.exe
File opened (read-only)	\??\q:	vhpfwybt.exe
File opened (read-only)	\??\g:	vhpfwybt.exe
File opened (read-only)	\??\y:	vhpfwybt.exe
File opened (read-only)	\??\t:	vhpfwybt.exe
File opened (read-only)	\??\a:	xjaczulxma.exe
File opened (read-only)	\??\a:	vhpfwybt.exe
File opened (read-only)	\??\k:	vhpfwybt.exe
File opened (read-only)	\??\l:	vhpfwybt.exe
File opened (read-only)	\??\s:	vhpfwybt.exe
File opened (read-only)	\??\n:	vhpfwybt.exe
File opened (read-only)	\??\w:	vhpfwybt.exe
File opened (read-only)	\??\y:	vhpfwybt.exe
File opened (read-only)	\??\w:	xjaczulxma.exe
File opened (read-only)	\??\p:	vhpfwybt.exe
File opened (read-only)	\??\s:	vhpfwybt.exe
File opened (read-only)	\??\n:	vhpfwybt.exe
File opened (read-only)	\??\u:	vhpfwybt.exe
File opened (read-only)	\??\m:	xjaczulxma.exe
File opened (read-only)	\??\y:	xjaczulxma.exe
File opened (read-only)	\??\m:	vhpfwybt.exe
File opened (read-only)	\??\p:	xjaczulxma.exe
File opened (read-only)	\??\x:	xjaczulxma.exe
File opened (read-only)	\??\b:	vhpfwybt.exe
File opened (read-only)	\??\e:	vhpfwybt.exe
File opened (read-only)	\??\i:	vhpfwybt.exe
File opened (read-only)	\??\z:	xjaczulxma.exe
File opened (read-only)	\??\h:	vhpfwybt.exe
File opened (read-only)	\??\e:	xjaczulxma.exe
File opened (read-only)	\??\t:	xjaczulxma.exe
File opened (read-only)	\??\p:	vhpfwybt.exe
File opened (read-only)	\??\r:	vhpfwybt.exe
File opened (read-only)	\??\k:	xjaczulxma.exe
File opened (read-only)	\??\i:	vhpfwybt.exe
File opened (read-only)	\??\j:	vhpfwybt.exe
File opened (read-only)	\??\t:	vhpfwybt.exe
File opened (read-only)	\??\v:	vhpfwybt.exe
File opened (read-only)	\??\q:	xjaczulxma.exe
File opened (read-only)	\??\s:	xjaczulxma.exe
File opened (read-only)	\??\r:	xjaczulxma.exe
File opened (read-only)	\??\u:	xjaczulxma.exe
File opened (read-only)	\??\g:	vhpfwybt.exe
File opened (read-only)	\??\r:	vhpfwybt.exe
File opened (read-only)	\??\z:	vhpfwybt.exe
File opened (read-only)	\??\o:	vhpfwybt.exe
File opened (read-only)	\??\z:	vhpfwybt.exe
File opened (read-only)	\??\m:	vhpfwybt.exe
File opened (read-only)	\??\o:	xjaczulxma.exe
File opened (read-only)	\??\v:	xjaczulxma.exe
File opened (read-only)	\??\g:	xjaczulxma.exe
File opened (read-only)	\??\l:	xjaczulxma.exe
File opened (read-only)	\??\u:	vhpfwybt.exe
File opened (read-only)	\??\n:	xjaczulxma.exe
File opened (read-only)	\??\e:	vhpfwybt.exe
File opened (read-only)	\??\w:	vhpfwybt.exe
File opened (read-only)	\??\j:	vhpfwybt.exe
File opened (read-only)	\??\l:	vhpfwybt.exe
File opened (read-only)	\??\o:	vhpfwybt.exe
File opened (read-only)	\??\a:	vhpfwybt.exe
File opened (read-only)	\??\k:	vhpfwybt.exe
File opened (read-only)	\??\b:	xjaczulxma.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	xjaczulxma.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	xjaczulxma.exe

AutoIT Executable 17 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/3032-0-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
behavioral1/files/0x000a00000001224c-17.dat	autoit_exe
behavioral1/files/0x000a00000001224c-27.dat	autoit_exe
behavioral1/files/0x0007000000015d50-37.dat	autoit_exe
behavioral1/files/0x0007000000015d50-33.dat	autoit_exe
behavioral1/files/0x000c000000015b12-40.dat	autoit_exe
behavioral1/files/0x0007000000015d50-41.dat	autoit_exe
behavioral1/files/0x0036000000015ce7-43.dat	autoit_exe
behavioral1/files/0x0036000000015ce7-42.dat	autoit_exe
behavioral1/files/0x0036000000015ce7-39.dat	autoit_exe
behavioral1/files/0x0036000000015ce7-31.dat	autoit_exe
behavioral1/files/0x0036000000015ce7-28.dat	autoit_exe
behavioral1/files/0x000c000000015b12-25.dat	autoit_exe
behavioral1/files/0x000c000000015b12-21.dat	autoit_exe
behavioral1/files/0x000a00000001224c-20.dat	autoit_exe
behavioral1/files/0x0006000000016d0e-73.dat	autoit_exe
behavioral1/files/0x0006000000016d16-78.dat	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\iamjgzogbqlgk.exe	73e013693da5ed75f739f5bfe74ed2d9.exe
File created	C:\Windows\SysWOW64\xjaczulxma.exe	73e013693da5ed75f739f5bfe74ed2d9.exe
File opened for modification	C:\Windows\SysWOW64\xjaczulxma.exe	73e013693da5ed75f739f5bfe74ed2d9.exe
File created	C:\Windows\SysWOW64\snijszwnnjpacyp.exe	73e013693da5ed75f739f5bfe74ed2d9.exe
File created	C:\Windows\SysWOW64\vhpfwybt.exe	73e013693da5ed75f739f5bfe74ed2d9.exe
File opened for modification	C:\Windows\SysWOW64\snijszwnnjpacyp.exe	73e013693da5ed75f739f5bfe74ed2d9.exe
File opened for modification	C:\Windows\SysWOW64\vhpfwybt.exe	73e013693da5ed75f739f5bfe74ed2d9.exe
File created	C:\Windows\SysWOW64\iamjgzogbqlgk.exe	73e013693da5ed75f739f5bfe74ed2d9.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	xjaczulxma.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vhpfwybt.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vhpfwybt.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vhpfwybt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	vhpfwybt.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vhpfwybt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	vhpfwybt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vhpfwybt.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vhpfwybt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vhpfwybt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	vhpfwybt.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	vhpfwybt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vhpfwybt.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	vhpfwybt.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	vhpfwybt.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\mydoc.rtf	73e013693da5ed75f739f5bfe74ed2d9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	xjaczulxma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	xjaczulxma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF8FFF9482D851B9146D62D7DE1BD95E130584667346342D79F"	73e013693da5ed75f739f5bfe74ed2d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	xjaczulxma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	xjaczulxma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2720	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
2892	xjaczulxma.exe
2892	xjaczulxma.exe
2892	xjaczulxma.exe
2892	xjaczulxma.exe
2892	xjaczulxma.exe
2780	vhpfwybt.exe
2780	vhpfwybt.exe
2780	vhpfwybt.exe
2780	vhpfwybt.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2140	snijszwnnjpacyp.exe
2140	snijszwnnjpacyp.exe
2140	snijszwnnjpacyp.exe
2140	snijszwnnjpacyp.exe
2896	vhpfwybt.exe
2896	vhpfwybt.exe
2896	vhpfwybt.exe
2896	vhpfwybt.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe
Token: SeShutdownPrivilege	1884	explorer.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
2892	xjaczulxma.exe
2892	xjaczulxma.exe
2892	xjaczulxma.exe
2780	vhpfwybt.exe
2780	vhpfwybt.exe
2780	vhpfwybt.exe
2140	snijszwnnjpacyp.exe
2140	snijszwnnjpacyp.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2896	vhpfwybt.exe
2896	vhpfwybt.exe
2896	vhpfwybt.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
3032	73e013693da5ed75f739f5bfe74ed2d9.exe
2892	xjaczulxma.exe
2892	xjaczulxma.exe
2892	xjaczulxma.exe
2780	vhpfwybt.exe
2780	vhpfwybt.exe
2780	vhpfwybt.exe
2140	snijszwnnjpacyp.exe
2140	snijszwnnjpacyp.exe
2140	snijszwnnjpacyp.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
2828	iamjgzogbqlgk.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe
1884	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	WINWORD.EXE
2720	WINWORD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2892	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	32
PID 3032 wrote to memory of 2892	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	32
PID 3032 wrote to memory of 2892	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	32
PID 3032 wrote to memory of 2892	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	32
PID 3032 wrote to memory of 2140	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	31
PID 3032 wrote to memory of 2140	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	31
PID 3032 wrote to memory of 2140	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	31
PID 3032 wrote to memory of 2140	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	31
PID 3032 wrote to memory of 2780	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	30
PID 3032 wrote to memory of 2780	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	30
PID 3032 wrote to memory of 2780	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	30
PID 3032 wrote to memory of 2780	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	30
PID 3032 wrote to memory of 2828	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	27
PID 3032 wrote to memory of 2828	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	27
PID 3032 wrote to memory of 2828	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	27
PID 3032 wrote to memory of 2828	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	27
PID 2892 wrote to memory of 2896	2892	xjaczulxma.exe	28
PID 2892 wrote to memory of 2896	2892	xjaczulxma.exe	28
PID 2892 wrote to memory of 2896	2892	xjaczulxma.exe	28
PID 2892 wrote to memory of 2896	2892	xjaczulxma.exe	28
PID 3032 wrote to memory of 2720	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	29
PID 3032 wrote to memory of 2720	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	29
PID 3032 wrote to memory of 2720	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	29
PID 3032 wrote to memory of 2720	3032	73e013693da5ed75f739f5bfe74ed2d9.exe	29

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\73e013693da5ed75f739f5bfe74ed2d9.exe
"C:\Users\Admin\AppData\Local\Temp\73e013693da5ed75f739f5bfe74ed2d9.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\iamjgzogbqlgk.exe
  iamjgzogbqlgk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2828
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2720
- C:\Windows\SysWOW64\vhpfwybt.exe
  vhpfwybt.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2780
- C:\Windows\SysWOW64\snijszwnnjpacyp.exe
  snijszwnnjpacyp.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2140
- C:\Windows\SysWOW64\xjaczulxma.exe
  xjaczulxma.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2892

C:\Windows\SysWOW64\vhpfwybt.exe
C:\Windows\system32\vhpfwybt.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2896

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
512KB

MD5
91759e10a6c18930199efab5122f0e0b

SHA1
21f2126891f7b59b25a8c248171fffe9e7352700

SHA256
23ce90b3403cee435cdd3f96b5ab61f935b8a31d2ec61a725d40d0f0e1a6aa9d

SHA512
bb35e196f8b5d2f08590adc11cc30bdbcde4695b06779cc295035a168398a9f4e81a9853fb89256b01fd2775d8e9a91e291e89230fafae818029c6e331888f5e

Download Submit
C:\Users\Admin\Documents\StartUpdate.doc.exe

Filesize
512KB

MD5
66834dade74f423f4ccc2d2d1e93d6c1

SHA1
40d79152119d8a02aa37194195377547b85b5ab4

SHA256
f2b8716506888f64a791f292d6498da71221abff97d3cdaa84fd19c86e612085

SHA512
3aa9eeba7dccb867f7348ab9c5a3801a1dcfabf7943a95599e67e867c4c1c0421885aba50779f896da3cfc4e354baeef6c45922056028dd701a813d9275d9b6e

Download Submit
C:\Windows\SysWOW64\iamjgzogbqlgk.exe

Filesize
303KB

MD5
3bf30faa6958623c563e4ed823156ec7

SHA1
4ef8635ca7a346d48537b570b31e88257aef2c46

SHA256
5b18ddbb91ab71fa3f1d514567b3906626b8f6d1e1973ab8885742517759b681

SHA512
631d1c972f2ffca0014ca5d4901353136c017c8c4feef4529d85174bdff86233499e177c7981a7991dba190f2206f5339b7d8a0d09ac806d4baffb87640bdb7e

Download Submit
C:\Windows\SysWOW64\iamjgzogbqlgk.exe

Filesize
188KB

MD5
6c4f87be0d901be08c372daf1970dc31

SHA1
804b4370fc56ca2fce5f87a0d9802aca001fde17

SHA256
c7e806a84db9031b1b1b637a4e031fb93cffb6dcf99388aa1e6b4c5310442297

SHA512
3b3ac05dee7b3e5b448cb6895d5039172f2a534ee4b85760e1e02d5749b0bbd5e52fa26c3c0ba5605e59352665a86dda119eb897f7cf8a2562fa8167a7d8ce05

Download Submit
C:\Windows\SysWOW64\snijszwnnjpacyp.exe

Filesize
512KB

MD5
9fda1e824323268f6806022d152ce344

SHA1
0f47e580fb18720fddcf754fb09696887d1600fe

SHA256
6b311c8f6a0326a2166e05ddaa2a7031a3cbd1b8da28db621770381f302007b0

SHA512
45ca9f5b4a03a27edd4edd827152807697387e1109c360a99e25783169eed5f2848583c4df008526fd2fc951dd9613aed13880f79336f74c0c90d6d522f8297a

Download Submit
C:\Windows\SysWOW64\snijszwnnjpacyp.exe

Filesize
393KB

MD5
0d38625b1e50aa72fc74137f5b81131a

SHA1
f19aa333f97cdb616452995ebb2b425a7c1c62c4

SHA256
ac5cd2979c952ca980515e8ec024720961084c83c9a4dc278dbb1b04614fffa9

SHA512
e7c77dbc28d581f0d479e0ecf9d318ef29b4bba8b7b778d650eddb87ec3107c7e9d94295b8a5e0fd47c6305a2cc6ea9af766547468b6e8a1dd98fd2fb5cbf3ad

Download Submit
C:\Windows\SysWOW64\vhpfwybt.exe

Filesize
284KB

MD5
7928cac9b08714b21048bb6d256c514e

SHA1
9e4e6c785ff4bb27e7bd703485924ef869865512

SHA256
a45bb58b9bdb9413144961f228f4b9dbffd01d35252b5364dc40f919129277af

SHA512
eafbef794662eebc7d7c272347962c32a4a9b691e52f4945ef5e32b33ec1e670debf520c40007abc8c72cd042dabf3db6f94a59dee05e245d9c0f5bebf6baf2c

Download Submit
C:\Windows\SysWOW64\vhpfwybt.exe

Filesize
512KB

MD5
17137e2d08a6fc11b3fec34a34dc2c9d

SHA1
effe5c8a2ba6e003e866bb6f9179a42d49eab756

SHA256
8a9f3de2919f3bd6f58f4635776a880d152530cec734ce715af32eaac9f11ffa

SHA512
c65cb6397be036d620f57a49a9a81940ed70cc528eb76b3e8f72fad73f67bf279779ec6ba64cff02c832ae4fb9fa062c4bb2a2fa56b5eb807945d17f9a7d3fed

Download Submit
C:\Windows\SysWOW64\vhpfwybt.exe

Filesize
471KB

MD5
c211553462d67e19a8f4b80e617c2690

SHA1
68d3d15aaf4cc745fc645f4305bb656af6bd9438

SHA256
ed24a6fd90d1042855a360f24c29a1c7302b7d36ef3353eb95209f60f37bfd2c

SHA512
b5fd9fcc64aa3f6bb8a7a0ed264f9f83a9239a8439f3be8bc5827add21cf14a66ce220f1c05ffefc2faaa9786cc5e69ae6932f7b6dd5a67b94ca63ab020bf464

Download Submit
C:\Windows\SysWOW64\xjaczulxma.exe

Filesize
469KB

MD5
f219747f312925d1663c19df57744c15

SHA1
dc8f9d866b8c271782249122eb1616540fa4aebd

SHA256
c9b5f18626d4c5d76679f269f8b100bb7ffe1eb3259dcb190d396f4f7860f6a7

SHA512
73cfc9efd7bd98fa6de6a09a132cc2433076e1329f7b0f0410614ffa1ef1f33c4121463aa89581b630941a9445c1338dea6a3ffdc60d3e187ef0c68329469ada

Download Submit
C:\Windows\SysWOW64\xjaczulxma.exe

Filesize
287KB

MD5
88eef07ca7dce82840e000880058d329

SHA1
fcc219db30b4023a2e6bd55fad2f73bacd00a2b5

SHA256
085ef67f0f6d588ede31395b5c47d02f7ef1e92edc33d41ba06e46e8b48f8af8

SHA512
5ef211059a9602be6bbbb444f1b51a6c8278e834d090e66cfe6d5b95c55da5bfc2c76f364de580d903f534106575413b9e3c8d67f328036ddeedbff115b8d752

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\iamjgzogbqlgk.exe

Filesize
158KB

MD5
51559cc28173a2e13719f0c3ab031c73

SHA1
5662a7749c9a08a143859a803a5d4559f76afa15

SHA256
4424b1d0f19c2b7aa53e7f9e5a0d895c57be9ea6efae4a49812ca948a1be0c15

SHA512
b9c150fcd5466f3e861e731b3293300981e78b657441b59a7974ce6c7f046848539ad380d2b37cab8289f6677c0bf0745928a2470aafc8f76e8ad9f89c089928

Download Submit
\Windows\SysWOW64\snijszwnnjpacyp.exe

Filesize
477KB

MD5
1fe2838ba5265ed43a52a1ca04b75e7e

SHA1
08b3f613db4184d4d75908e85c7418bb458e064c

SHA256
4eb1efca2de359e22e183ad912d99b10b0293277fad3ddde13cac2a16eb7386b

SHA512
c301b0f414cd32dd7576f9725ba64a3584a5fd82ea45b16001ab30756f15379770dd954b39c8ad2b86043e8d2167313ce3371ce39b537eb2134e5975a3001f74

Download Submit
\Windows\SysWOW64\vhpfwybt.exe

Filesize
212KB

MD5
a18931acf8aaa615751cc45f4e322f95

SHA1
edf3950964ff69036d2abe0b7b3a1ee30245e234

SHA256
27286616e6fffc1c46ec0d76933b6f8218eafe15b08d02795817aa19b1b72148

SHA512
82f749acf64829a40310a058088413e459aa18b60d18f0d7150b03ddbc674655ca5637657bf7fe04a5d6b4f15a3d68647c3be4c02d63153ec2148200e62090dd

Download Submit
\Windows\SysWOW64\vhpfwybt.exe

Filesize
374KB

MD5
3656360bee7cee9d776a09da7086a9a5

SHA1
9af3834a25e442450fb2057eb251347a85bc76e7

SHA256
65185840f4494a0c7511ae696d343ef96291246e2c8f62ee85b7cb7f07171baf

SHA512
a0fb8fbf6c335da2a59e1f1af1d922bb2e817f085ec1c25ce362a6a4caf767f2e9198e8ada7d864fc3887c0cda81d583c747f2112d444c9acc163d9584ebeff2

Download Submit
\Windows\SysWOW64\xjaczulxma.exe

Filesize
333KB

MD5
c079064d76a6eee7bdaf7762e85ae99e

SHA1
050b19d681c53c659d73700c36dde5c6358df975

SHA256
9af4cfade69a3d63d955a7c58357af9aba7a15c14c2e1e6bcee500caeea9983c

SHA512
3086cf2739405c7048b49d750f6edb2937b18248c74a4e79b6311510ff30ae53ee87dab915629b62760dced8424bdbda817709fef4bb1de7aa405d47e39983b8

Download Submit
memory/1884-80-0x00000000041E0000-0x00000000041E1000-memory.dmp

Filesize
4KB

Download
memory/1884-83-0x00000000041E0000-0x00000000041E1000-memory.dmp

Filesize
4KB

Download
memory/1884-88-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/2720-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2720-47-0x0000000070B6D000-0x0000000070B78000-memory.dmp

Filesize
44KB

Download
memory/2720-45-0x000000002F731000-0x000000002F732000-memory.dmp

Filesize
4KB

Download
memory/2720-81-0x0000000070B6D000-0x0000000070B78000-memory.dmp

Filesize
44KB

Download
memory/3032-0-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download