785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SVCHOST.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SVCHOST.EXE

Executes dropped EXE 15 IoCs

pid	Process
3496	SVCHOST.EXE
4052	SVCHOST.EXE
1292	SPOOLSV.EXE
1144	SVCHOST.EXE
3660	SPOOLSV.EXE
3492	CTFMON.EXE
3724	SVCHOST.EXE
4772	SPOOLSV.EXE
3768	CTFMON.EXE
3456	CTFMON.EXE
5040	SPOOLSV.EXE
4876	CTFMON.EXE
1972	SVCHOST.EXE
1880	SPOOLSV.EXE
4808	CTFMON.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Recycled\desktop.ini	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\S:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\O:	CTFMON.EXE
File opened (read-only)	\??\Z:	CTFMON.EXE
File opened (read-only)	\??\E:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\T:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\G:	SVCHOST.EXE
File opened (read-only)	\??\J:	SVCHOST.EXE
File opened (read-only)	\??\Y:	SVCHOST.EXE
File opened (read-only)	\??\W:	CTFMON.EXE
File opened (read-only)	\??\F:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\P:	SVCHOST.EXE
File opened (read-only)	\??\W:	SVCHOST.EXE
File opened (read-only)	\??\H:	SPOOLSV.EXE
File opened (read-only)	\??\L:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\O:	SVCHOST.EXE
File opened (read-only)	\??\Q:	SVCHOST.EXE
File opened (read-only)	\??\U:	SPOOLSV.EXE
File opened (read-only)	\??\F:	CTFMON.EXE
File opened (read-only)	\??\M:	CTFMON.EXE
File opened (read-only)	\??\P:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\F:	SVCHOST.EXE
File opened (read-only)	\??\E:	SPOOLSV.EXE
File opened (read-only)	\??\Q:	SPOOLSV.EXE
File opened (read-only)	\??\R:	SPOOLSV.EXE
File opened (read-only)	\??\W:	SPOOLSV.EXE
File opened (read-only)	\??\X:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\I:	SPOOLSV.EXE
File opened (read-only)	\??\T:	CTFMON.EXE
File opened (read-only)	\??\Y:	CTFMON.EXE
File opened (read-only)	\??\U:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\Z:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\M:	SVCHOST.EXE
File opened (read-only)	\??\X:	SVCHOST.EXE
File opened (read-only)	\??\N:	SPOOLSV.EXE
File opened (read-only)	\??\N:	SVCHOST.EXE
File opened (read-only)	\??\Z:	SVCHOST.EXE
File opened (read-only)	\??\R:	CTFMON.EXE
File opened (read-only)	\??\H:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\I:	SVCHOST.EXE
File opened (read-only)	\??\V:	SPOOLSV.EXE
File opened (read-only)	\??\G:	CTFMON.EXE
File opened (read-only)	\??\G:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\K:	SVCHOST.EXE
File opened (read-only)	\??\X:	SPOOLSV.EXE
File opened (read-only)	\??\Y:	SPOOLSV.EXE
File opened (read-only)	\??\I:	CTFMON.EXE
File opened (read-only)	\??\P:	CTFMON.EXE
File opened (read-only)	\??\T:	SPOOLSV.EXE
File opened (read-only)	\??\J:	CTFMON.EXE
File opened (read-only)	\??\J:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\K:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\N:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\O:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\S:	SVCHOST.EXE
File opened (read-only)	\??\V:	SVCHOST.EXE
File opened (read-only)	\??\L:	CTFMON.EXE
File opened (read-only)	\??\Q:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\V:	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
File opened (read-only)	\??\R:	SVCHOST.EXE
File opened (read-only)	\??\U:	SVCHOST.EXE
File opened (read-only)	\??\P:	SPOOLSV.EXE
File opened (read-only)	\??\U:	CTFMON.EXE
File opened (read-only)	\??\M:	SPOOLSV.EXE
File opened (read-only)	\??\E:	CTFMON.EXE

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SPOOLSV.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SVCHOST.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\TileInfo = "prop:Type;Size"	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\TileInfo = "prop:Type;Size"	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\QuickTip = "prop:Type;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\TileInfo = "prop:Type;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	CTFMON.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\QuickTip = "prop:Type;Size"	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SPOOLSV.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\QuickTip = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\TileInfo = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\*\QuickTip = "prop:Type;Size"	CTFMON.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3952	WINWORD.EXE
3952	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
3492	CTFMON.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
1292	SPOOLSV.EXE
1292	SPOOLSV.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
3492	CTFMON.EXE
3496	SVCHOST.EXE
3496	SVCHOST.EXE
3496	SVCHOST.EXE
3496	SVCHOST.EXE

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
3496	SVCHOST.EXE
4052	SVCHOST.EXE
1292	SPOOLSV.EXE
1144	SVCHOST.EXE
3660	SPOOLSV.EXE
3492	CTFMON.EXE
3724	SVCHOST.EXE
4772	SPOOLSV.EXE
3768	CTFMON.EXE
3456	CTFMON.EXE
5040	SPOOLSV.EXE
4876	CTFMON.EXE
1972	SVCHOST.EXE
1880	SPOOLSV.EXE
4808	CTFMON.EXE
3952	WINWORD.EXE
3952	WINWORD.EXE
3952	WINWORD.EXE
3952	WINWORD.EXE
3952	WINWORD.EXE
3952	WINWORD.EXE
3952	WINWORD.EXE
3952	WINWORD.EXE
3952	WINWORD.EXE

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3496	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	84
PID 4092 wrote to memory of 3496	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	84
PID 4092 wrote to memory of 3496	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	84
PID 3496 wrote to memory of 4052	3496	SVCHOST.EXE	85
PID 3496 wrote to memory of 4052	3496	SVCHOST.EXE	85
PID 3496 wrote to memory of 4052	3496	SVCHOST.EXE	85
PID 3496 wrote to memory of 1292	3496	SVCHOST.EXE	86
PID 3496 wrote to memory of 1292	3496	SVCHOST.EXE	86
PID 3496 wrote to memory of 1292	3496	SVCHOST.EXE	86
PID 1292 wrote to memory of 1144	1292	SPOOLSV.EXE	87
PID 1292 wrote to memory of 1144	1292	SPOOLSV.EXE	87
PID 1292 wrote to memory of 1144	1292	SPOOLSV.EXE	87
PID 1292 wrote to memory of 3660	1292	SPOOLSV.EXE	88
PID 1292 wrote to memory of 3660	1292	SPOOLSV.EXE	88
PID 1292 wrote to memory of 3660	1292	SPOOLSV.EXE	88
PID 1292 wrote to memory of 3492	1292	SPOOLSV.EXE	89
PID 1292 wrote to memory of 3492	1292	SPOOLSV.EXE	89
PID 1292 wrote to memory of 3492	1292	SPOOLSV.EXE	89
PID 3492 wrote to memory of 3724	3492	CTFMON.EXE	90
PID 3492 wrote to memory of 3724	3492	CTFMON.EXE	90
PID 3492 wrote to memory of 3724	3492	CTFMON.EXE	90
PID 3492 wrote to memory of 4772	3492	CTFMON.EXE	91
PID 3492 wrote to memory of 4772	3492	CTFMON.EXE	91
PID 3492 wrote to memory of 4772	3492	CTFMON.EXE	91
PID 3492 wrote to memory of 3768	3492	CTFMON.EXE	92
PID 3492 wrote to memory of 3768	3492	CTFMON.EXE	92
PID 3492 wrote to memory of 3768	3492	CTFMON.EXE	92
PID 3496 wrote to memory of 3456	3496	SVCHOST.EXE	95
PID 3496 wrote to memory of 3456	3496	SVCHOST.EXE	95
PID 3496 wrote to memory of 3456	3496	SVCHOST.EXE	95
PID 4092 wrote to memory of 5040	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	96
PID 4092 wrote to memory of 5040	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	96
PID 4092 wrote to memory of 5040	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	96
PID 3496 wrote to memory of 1804	3496	SVCHOST.EXE	97
PID 3496 wrote to memory of 1804	3496	SVCHOST.EXE	97
PID 3496 wrote to memory of 1804	3496	SVCHOST.EXE	97
PID 4092 wrote to memory of 4876	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	98
PID 4092 wrote to memory of 4876	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	98
PID 4092 wrote to memory of 4876	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	98
PID 1804 wrote to memory of 1516	1804	userinit.exe	99
PID 1804 wrote to memory of 1516	1804	userinit.exe	99
PID 1804 wrote to memory of 1516	1804	userinit.exe	99
PID 4092 wrote to memory of 1972	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	101
PID 4092 wrote to memory of 1972	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	101
PID 4092 wrote to memory of 1972	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	101
PID 4092 wrote to memory of 1880	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	103
PID 4092 wrote to memory of 1880	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	103
PID 4092 wrote to memory of 1880	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	103
PID 4092 wrote to memory of 4808	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	104
PID 4092 wrote to memory of 4808	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	104
PID 4092 wrote to memory of 4808	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	104
PID 4092 wrote to memory of 3952	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	107
PID 4092 wrote to memory of 3952	4092	785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe	107

C:\Users\Admin\AppData\Local\Temp\785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe
"C:\Users\Admin\AppData\Local\Temp\785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092
- C:\recycled\SVCHOST.EXE
  C:\recycled\SVCHOST.EXE :agent
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\recycled\SVCHOST.EXE
    C:\recycled\SVCHOST.EXE :agent
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4052
- - C:\recycled\SPOOLSV.EXE
    C:\recycled\SPOOLSV.EXE :agent
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1144
  - - C:\recycled\SPOOLSV.EXE
      C:\recycled\SPOOLSV.EXE :agent
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3660
  - - C:\recycled\CTFMON.EXE
      C:\recycled\CTFMON.EXE :agent
      4⤵
      Modifies WinLogon for persistence
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Enumerates connected drives
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\recycled\SVCHOST.EXE
        
        C:\recycled\SVCHOST.EXE :agent
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
    - - C:\recycled\SPOOLSV.EXE
        
        C:\recycled\SPOOLSV.EXE :agent
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4772
    - - C:\recycled\CTFMON.EXE
        
        C:\recycled\CTFMON.EXE :agent
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3768
- - C:\recycled\CTFMON.EXE
    C:\recycled\CTFMON.EXE :agent
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3456
- - C:\Windows\SysWOW64\userinit.exe
    C:\Windows\system32\userinit.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\SysWOW64\Explorer.exe
      Explorer.exe "C:\recycled\SVCHOST.exe"
      4⤵
      PID:1516
- C:\recycled\SPOOLSV.EXE
  C:\recycled\SPOOLSV.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5040
- C:\recycled\CTFMON.EXE
  C:\recycled\CTFMON.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4876
- C:\recycled\SVCHOST.EXE
  C:\recycled\SVCHOST.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1972
- C:\recycled\SPOOLSV.EXE
  C:\recycled\SPOOLSV.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1880
- C:\recycled\CTFMON.EXE
  C:\recycled\CTFMON.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4808
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\785ed07200948fccfa7c4ac7690f4010c0741af387c4ce012a40e8070e036920.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3952

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery