Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 19:06
Static task
static1
Behavioral task
behavioral1
Sample
7b08b4850997162cb775641f8e651d38.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7b08b4850997162cb775641f8e651d38.exe
Resource
win10v2004-20231222-en
General
-
Target
7b08b4850997162cb775641f8e651d38.exe
-
Size
512KB
-
MD5
7b08b4850997162cb775641f8e651d38
-
SHA1
1e6b1cda9e5485d687e0c8cbcee9e860c133ea86
-
SHA256
567f54e9750445ceee03431cf67310b5b258d25ba9ac4c686989b56b61b1118a
-
SHA512
5c2959ce5df916279ca4d3b4e35e9e89b65b0928f925c68fb5c1e1fe39a1d0e68bdf49b797e506872a0297991f8285b19ff8a675bd3612d0b4d22a82edbc6cda
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6p:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5w
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fegeeavroo.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fegeeavroo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fegeeavroo.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" fegeeavroo.exe -
Executes dropped EXE 5 IoCs
pid Process 2672 fegeeavroo.exe 3032 riqkqqdzschppai.exe 2736 rhcxmjrp.exe 2256 xqlbhxesciugz.exe 2684 rhcxmjrp.exe -
Loads dropped DLL 5 IoCs
pid Process 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2672 fegeeavroo.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" fegeeavroo.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vtufuzwg = "fegeeavroo.exe" riqkqqdzschppai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lvgyfgyu = "riqkqqdzschppai.exe" riqkqqdzschppai.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xqlbhxesciugz.exe" riqkqqdzschppai.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: rhcxmjrp.exe File opened (read-only) \??\u: fegeeavroo.exe File opened (read-only) \??\g: rhcxmjrp.exe File opened (read-only) \??\z: rhcxmjrp.exe File opened (read-only) \??\z: rhcxmjrp.exe File opened (read-only) \??\b: fegeeavroo.exe File opened (read-only) \??\m: fegeeavroo.exe File opened (read-only) \??\t: rhcxmjrp.exe File opened (read-only) \??\x: rhcxmjrp.exe File opened (read-only) \??\q: rhcxmjrp.exe File opened (read-only) \??\y: fegeeavroo.exe File opened (read-only) \??\n: rhcxmjrp.exe File opened (read-only) \??\q: rhcxmjrp.exe File opened (read-only) \??\l: fegeeavroo.exe File opened (read-only) \??\h: rhcxmjrp.exe File opened (read-only) \??\n: rhcxmjrp.exe File opened (read-only) \??\g: rhcxmjrp.exe File opened (read-only) \??\o: rhcxmjrp.exe File opened (read-only) \??\j: rhcxmjrp.exe File opened (read-only) \??\s: rhcxmjrp.exe File opened (read-only) \??\y: rhcxmjrp.exe File opened (read-only) \??\x: fegeeavroo.exe File opened (read-only) \??\i: rhcxmjrp.exe File opened (read-only) \??\s: rhcxmjrp.exe File opened (read-only) \??\e: fegeeavroo.exe File opened (read-only) \??\z: fegeeavroo.exe File opened (read-only) \??\v: rhcxmjrp.exe File opened (read-only) \??\e: rhcxmjrp.exe File opened (read-only) \??\k: rhcxmjrp.exe File opened (read-only) \??\a: fegeeavroo.exe File opened (read-only) \??\o: fegeeavroo.exe File opened (read-only) \??\v: fegeeavroo.exe File opened (read-only) \??\u: rhcxmjrp.exe File opened (read-only) \??\w: rhcxmjrp.exe File opened (read-only) \??\k: fegeeavroo.exe File opened (read-only) \??\s: fegeeavroo.exe File opened (read-only) \??\t: rhcxmjrp.exe File opened (read-only) \??\i: fegeeavroo.exe File opened (read-only) \??\m: rhcxmjrp.exe File opened (read-only) \??\m: rhcxmjrp.exe File opened (read-only) \??\h: rhcxmjrp.exe File opened (read-only) \??\r: fegeeavroo.exe File opened (read-only) \??\t: fegeeavroo.exe File opened (read-only) \??\w: rhcxmjrp.exe File opened (read-only) \??\a: rhcxmjrp.exe File opened (read-only) \??\l: rhcxmjrp.exe File opened (read-only) \??\p: rhcxmjrp.exe File opened (read-only) \??\u: rhcxmjrp.exe File opened (read-only) \??\x: rhcxmjrp.exe File opened (read-only) \??\h: fegeeavroo.exe File opened (read-only) \??\i: rhcxmjrp.exe File opened (read-only) \??\k: rhcxmjrp.exe File opened (read-only) \??\j: rhcxmjrp.exe File opened (read-only) \??\b: rhcxmjrp.exe File opened (read-only) \??\e: rhcxmjrp.exe File opened (read-only) \??\l: rhcxmjrp.exe File opened (read-only) \??\r: rhcxmjrp.exe File opened (read-only) \??\p: fegeeavroo.exe File opened (read-only) \??\w: fegeeavroo.exe File opened (read-only) \??\o: rhcxmjrp.exe File opened (read-only) \??\q: fegeeavroo.exe File opened (read-only) \??\a: rhcxmjrp.exe File opened (read-only) \??\g: fegeeavroo.exe File opened (read-only) \??\j: fegeeavroo.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" fegeeavroo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" fegeeavroo.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2076-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000d0000000122c5-5.dat autoit_exe behavioral1/files/0x000a000000012243-17.dat autoit_exe behavioral1/files/0x00070000000155e9-32.dat autoit_exe behavioral1/files/0x00070000000155e9-41.dat autoit_exe behavioral1/files/0x002d000000014f56-40.dat autoit_exe behavioral1/files/0x000500000001869b-73.dat autoit_exe behavioral1/files/0x00050000000186a3-75.dat autoit_exe behavioral1/files/0x0006000000018ae8-77.dat autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rhcxmjrp.exe 7b08b4850997162cb775641f8e651d38.exe File created C:\Windows\SysWOW64\xqlbhxesciugz.exe 7b08b4850997162cb775641f8e651d38.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll fegeeavroo.exe File created C:\Windows\SysWOW64\riqkqqdzschppai.exe 7b08b4850997162cb775641f8e651d38.exe File opened for modification C:\Windows\SysWOW64\riqkqqdzschppai.exe 7b08b4850997162cb775641f8e651d38.exe File created C:\Windows\SysWOW64\rhcxmjrp.exe 7b08b4850997162cb775641f8e651d38.exe File opened for modification C:\Windows\SysWOW64\xqlbhxesciugz.exe 7b08b4850997162cb775641f8e651d38.exe File created C:\Windows\SysWOW64\fegeeavroo.exe 7b08b4850997162cb775641f8e651d38.exe File opened for modification C:\Windows\SysWOW64\fegeeavroo.exe 7b08b4850997162cb775641f8e651d38.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe rhcxmjrp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe rhcxmjrp.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe rhcxmjrp.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe rhcxmjrp.exe File created \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe rhcxmjrp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal rhcxmjrp.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe rhcxmjrp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal rhcxmjrp.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe rhcxmjrp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe rhcxmjrp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal rhcxmjrp.exe File opened for modification \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe rhcxmjrp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe rhcxmjrp.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal rhcxmjrp.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 7b08b4850997162cb775641f8e651d38.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB2B15B479438EA53BABAA733E8D4BF" 7b08b4850997162cb775641f8e651d38.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" fegeeavroo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" fegeeavroo.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" fegeeavroo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg fegeeavroo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh fegeeavroo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2636 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 3032 riqkqqdzschppai.exe 3032 riqkqqdzschppai.exe 3032 riqkqqdzschppai.exe 3032 riqkqqdzschppai.exe 3032 riqkqqdzschppai.exe 2672 fegeeavroo.exe 2672 fegeeavroo.exe 2672 fegeeavroo.exe 2672 fegeeavroo.exe 2672 fegeeavroo.exe 2736 rhcxmjrp.exe 2736 rhcxmjrp.exe 2736 rhcxmjrp.exe 2736 rhcxmjrp.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 2684 rhcxmjrp.exe 2684 rhcxmjrp.exe 2684 rhcxmjrp.exe 2684 rhcxmjrp.exe 3032 riqkqqdzschppai.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 3032 riqkqqdzschppai.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 3032 riqkqqdzschppai.exe 3032 riqkqqdzschppai.exe 3032 riqkqqdzschppai.exe 2672 fegeeavroo.exe 2672 fegeeavroo.exe 2672 fegeeavroo.exe 2736 rhcxmjrp.exe 2736 rhcxmjrp.exe 2736 rhcxmjrp.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 2684 rhcxmjrp.exe 2684 rhcxmjrp.exe 2684 rhcxmjrp.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 2076 7b08b4850997162cb775641f8e651d38.exe 3032 riqkqqdzschppai.exe 3032 riqkqqdzschppai.exe 3032 riqkqqdzschppai.exe 2672 fegeeavroo.exe 2672 fegeeavroo.exe 2672 fegeeavroo.exe 2736 rhcxmjrp.exe 2736 rhcxmjrp.exe 2736 rhcxmjrp.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 2256 xqlbhxesciugz.exe 2684 rhcxmjrp.exe 2684 rhcxmjrp.exe 2684 rhcxmjrp.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2636 WINWORD.EXE 2636 WINWORD.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2672 2076 7b08b4850997162cb775641f8e651d38.exe 28 PID 2076 wrote to memory of 2672 2076 7b08b4850997162cb775641f8e651d38.exe 28 PID 2076 wrote to memory of 2672 2076 7b08b4850997162cb775641f8e651d38.exe 28 PID 2076 wrote to memory of 2672 2076 7b08b4850997162cb775641f8e651d38.exe 28 PID 2076 wrote to memory of 3032 2076 7b08b4850997162cb775641f8e651d38.exe 29 PID 2076 wrote to memory of 3032 2076 7b08b4850997162cb775641f8e651d38.exe 29 PID 2076 wrote to memory of 3032 2076 7b08b4850997162cb775641f8e651d38.exe 29 PID 2076 wrote to memory of 3032 2076 7b08b4850997162cb775641f8e651d38.exe 29 PID 2076 wrote to memory of 2736 2076 7b08b4850997162cb775641f8e651d38.exe 31 PID 2076 wrote to memory of 2736 2076 7b08b4850997162cb775641f8e651d38.exe 31 PID 2076 wrote to memory of 2736 2076 7b08b4850997162cb775641f8e651d38.exe 31 PID 2076 wrote to memory of 2736 2076 7b08b4850997162cb775641f8e651d38.exe 31 PID 2076 wrote to memory of 2256 2076 7b08b4850997162cb775641f8e651d38.exe 30 PID 2076 wrote to memory of 2256 2076 7b08b4850997162cb775641f8e651d38.exe 30 PID 2076 wrote to memory of 2256 2076 7b08b4850997162cb775641f8e651d38.exe 30 PID 2076 wrote to memory of 2256 2076 7b08b4850997162cb775641f8e651d38.exe 30 PID 2076 wrote to memory of 2636 2076 7b08b4850997162cb775641f8e651d38.exe 32 PID 2076 wrote to memory of 2636 2076 7b08b4850997162cb775641f8e651d38.exe 32 PID 2076 wrote to memory of 2636 2076 7b08b4850997162cb775641f8e651d38.exe 32 PID 2076 wrote to memory of 2636 2076 7b08b4850997162cb775641f8e651d38.exe 32 PID 2672 wrote to memory of 2684 2672 fegeeavroo.exe 33 PID 2672 wrote to memory of 2684 2672 fegeeavroo.exe 33 PID 2672 wrote to memory of 2684 2672 fegeeavroo.exe 33 PID 2672 wrote to memory of 2684 2672 fegeeavroo.exe 33 PID 2636 wrote to memory of 1888 2636 WINWORD.EXE 36 PID 2636 wrote to memory of 1888 2636 WINWORD.EXE 36 PID 2636 wrote to memory of 1888 2636 WINWORD.EXE 36 PID 2636 wrote to memory of 1888 2636 WINWORD.EXE 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b08b4850997162cb775641f8e651d38.exe"C:\Users\Admin\AppData\Local\Temp\7b08b4850997162cb775641f8e651d38.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\fegeeavroo.exefegeeavroo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\rhcxmjrp.exeC:\Windows\system32\rhcxmjrp.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2684
-
-
-
C:\Windows\SysWOW64\riqkqqdzschppai.exeriqkqqdzschppai.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3032
-
-
C:\Windows\SysWOW64\xqlbhxesciugz.exexqlbhxesciugz.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2256
-
-
C:\Windows\SysWOW64\rhcxmjrp.exerhcxmjrp.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2736
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1888
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5cd4c57d9a1e0e86ac5814b1d4a4f9cfb
SHA129992372050297f9f60792aa247afd0f445fdfbb
SHA256d1cf0817e3b3217d019f433850752ba161892c6f59939f7102eab40047d20599
SHA512f5f18a47d9a771fec6a696c0bf68e479f4db330226d553f24c790fe9103eb5bebe4a6888091a3de644ef708f15e06507977af13512b17f338007610390cde970
-
Filesize
512KB
MD58210a1e6d63f0a2ece51b0c05a1b9334
SHA1787625d067d42d9896e0a05b94713021989adb11
SHA2560fd4f6e57f0b1e10c54c4a8eb8021032a736e932d5e4788bad7bbdf3922205e5
SHA512bdd9f563192afa89d5098f605b524c8945813ab0859e39d428f11546889d12d9e285356bc06e682f8b9044e6fe2c79fb52543fbb8270df0f681519ec985b7cc7
-
Filesize
20KB
MD5e98982095f15d1c9e2668b8d895738d0
SHA10c65301fd7d1e09307bef90ccaf4646b64aa6f94
SHA2568080919a0d6a653c97ea70d5dd90f088cfa2c03db96e834fb6fe237eb51da677
SHA5120280a0a8420f1312c23996da75cf8bad7e10f3abf7585d3dc06802bcf1edaac39a5a293e4fe1cfb143132d99f8740b3589eaf7745deebafdb59c5110de0eda2a
-
Filesize
512KB
MD528b47e2ce385d097513b6235917138a2
SHA152bd738db83105585fa4aba26c909ed54c9d38fa
SHA25661d509679c902050193ca7e30fc2f8c3b75a53d7f5cc97b0760258037c891b3c
SHA5121dba8775ec36286d350c0417da6c6bffceaae182e8541f07483c9dad767542cd3ad52689b11f9d126cf9b2071f60bb93f19bdb21c99ca5e716b05caa2b1fa9f8
-
Filesize
512KB
MD528521a24d09fd4f0177f001e0299c23d
SHA1aeaddc371a25772dbe855c779902b0f63dd46082
SHA2565dbc402264c6b8e5d1b4c9575bd7019a2984b2652f8190eb9571b96818f084f2
SHA51207cf620e79224050b7f124d3b84e1c069ad2bbdfecaa82f52c0339836d2da1c7d790f3513fec39f5df67423c06484b3d3fae2912692b54704587e38aa056129a
-
Filesize
512KB
MD57375cd5a300db782bc21b5fe175e135d
SHA1e6842a3618303f7b6487adfcdfe85bc67adee2ca
SHA2563a02aaba49ea4f750747e6b51e4e6c40ceaf7a31754cfa44c63d421306b033b8
SHA51204bf4ace307d4872487fe0412e688024305a14b0fa999cffa3ebb52032b28f7c2c10d2590222aa8a5e637bd7185e3bc88d5b6eade10957be29ca1c9fcdc1fc05
-
Filesize
512KB
MD572abd75f07a8f9164db208db8c9933df
SHA15e2ef3c7b297ea25a47a04d02e439aa3c581065b
SHA2560b256c553aeb008977e2d395c6a6cdd6c4dbcc74ca80d2177c68dd12265b9590
SHA51229b0dd58187f3fe18e725367721a8a10e123a5e1ea6b13cbae387a72624ca3fa842da1700caabc6b9f1406fe48836de5d2f3a499adbf7c1a37f6a58181718ead
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5982fed46df051de9e2541ad899565a4b
SHA1fc1b0c3e4d67880f46b073323c5bf9d43681c6d4
SHA25629cfb3670ce0e286d3cab4e4f2f1011a2f17f52ac513bacfbd8825408b0ba674
SHA512e474940b82176683fe448523a3fccd060e26c2a829b230ff558d4afcb6cf159f5dcf1a1056cfa5b0f80b162eac8555b75e6fa03b9671a7e830e9a3c513007a42
-
Filesize
64KB
MD5d76d22b81130bc9206c7c947d7a9ea5e
SHA15956e88a6ec7949ce5a350e21703307d855f34b1
SHA256b96acd28ea28c51de470bf63ebbc33a346440fe63e236ab9f092e0cb3035b870
SHA512112f4f23127929556f27e12a7979ebd1536af790c92f8ff7870a5b39470bd02d83fbf1697e7ab3eccebd71c44ae7bfbd1dac9c39fefa6e15a488baf840b8aaf1