dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SVCHOST.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SVCHOST.EXE

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SVCHOST.EXE

Executes dropped EXE 12 IoCs

pid	Process
4072	SVCHOST.EXE
3056	SVCHOST.EXE
5116	SPOOLSV.EXE
4360	SVCHOST.EXE
4984	SPOOLSV.EXE
2040	CTFMON.EXE
1124	SVCHOST.EXE
2332	SPOOLSV.EXE
2616	CTFMON.EXE
2808	CTFMON.EXE
240	SPOOLSV.EXE
1536	CTFMON.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Recycled\desktop.ini	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\K:	SVCHOST.EXE
File opened (read-only)	\??\V:	SVCHOST.EXE
File opened (read-only)	\??\R:	SPOOLSV.EXE
File opened (read-only)	\??\S:	CTFMON.EXE
File opened (read-only)	\??\W:	CTFMON.EXE
File opened (read-only)	\??\Y:	CTFMON.EXE
File opened (read-only)	\??\F:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\I:	SVCHOST.EXE
File opened (read-only)	\??\M:	SPOOLSV.EXE
File opened (read-only)	\??\O:	SPOOLSV.EXE
File opened (read-only)	\??\X:	CTFMON.EXE
File opened (read-only)	\??\L:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\G:	SVCHOST.EXE
File opened (read-only)	\??\J:	SVCHOST.EXE
File opened (read-only)	\??\Y:	SVCHOST.EXE
File opened (read-only)	\??\J:	SPOOLSV.EXE
File opened (read-only)	\??\L:	SPOOLSV.EXE
File opened (read-only)	\??\J:	CTFMON.EXE
File opened (read-only)	\??\K:	CTFMON.EXE
File opened (read-only)	\??\H:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\S:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\E:	SVCHOST.EXE
File opened (read-only)	\??\R:	SVCHOST.EXE
File opened (read-only)	\??\P:	SPOOLSV.EXE
File opened (read-only)	\??\X:	SPOOLSV.EXE
File opened (read-only)	\??\H:	CTFMON.EXE
File opened (read-only)	\??\H:	SPOOLSV.EXE
File opened (read-only)	\??\I:	SPOOLSV.EXE
File opened (read-only)	\??\O:	CTFMON.EXE
File opened (read-only)	\??\Z:	CTFMON.EXE
File opened (read-only)	\??\R:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\U:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\F:	SVCHOST.EXE
File opened (read-only)	\??\T:	SVCHOST.EXE
File opened (read-only)	\??\E:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\T:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\X:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\S:	SVCHOST.EXE
File opened (read-only)	\??\E:	CTFMON.EXE
File opened (read-only)	\??\G:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\V:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\H:	SVCHOST.EXE
File opened (read-only)	\??\P:	SVCHOST.EXE
File opened (read-only)	\??\U:	SVCHOST.EXE
File opened (read-only)	\??\E:	SPOOLSV.EXE
File opened (read-only)	\??\V:	SPOOLSV.EXE
File opened (read-only)	\??\P:	CTFMON.EXE
File opened (read-only)	\??\Z:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\Q:	SVCHOST.EXE
File opened (read-only)	\??\I:	CTFMON.EXE
File opened (read-only)	\??\T:	CTFMON.EXE
File opened (read-only)	\??\U:	CTFMON.EXE
File opened (read-only)	\??\M:	SVCHOST.EXE
File opened (read-only)	\??\N:	SVCHOST.EXE
File opened (read-only)	\??\X:	SVCHOST.EXE
File opened (read-only)	\??\Y:	SPOOLSV.EXE
File opened (read-only)	\??\Q:	CTFMON.EXE
File opened (read-only)	\??\J:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
File opened (read-only)	\??\Z:	SVCHOST.EXE
File opened (read-only)	\??\G:	SPOOLSV.EXE
File opened (read-only)	\??\W:	SPOOLSV.EXE
File opened (read-only)	\??\L:	CTFMON.EXE
File opened (read-only)	\??\V:	CTFMON.EXE
File opened (read-only)	\??\K:	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 29 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\TileInfo = "prop:Type;Size"	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\QuickTip = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\TileInfo = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\QuickTip = "prop:Type;Size"	SPOOLSV.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\TileInfo = "prop:Type;Size"	SPOOLSV.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	CTFMON.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\QuickTip = "prop:Type;Size"	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\QuickTip = "prop:Type;Size"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\TileInfo = "prop:Type;Size"	CTFMON.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4648	WINWORD.EXE
4648	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2040	CTFMON.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
5116	SPOOLSV.EXE
5116	SPOOLSV.EXE
2040	CTFMON.EXE
2040	CTFMON.EXE
2040	CTFMON.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE
4072	SVCHOST.EXE

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
4072	SVCHOST.EXE
3056	SVCHOST.EXE
5116	SPOOLSV.EXE
4360	SVCHOST.EXE
4984	SPOOLSV.EXE
2040	CTFMON.EXE
1124	SVCHOST.EXE
2332	SPOOLSV.EXE
2616	CTFMON.EXE
2808	CTFMON.EXE
240	SPOOLSV.EXE
1536	CTFMON.EXE
4648	WINWORD.EXE
4648	WINWORD.EXE
4648	WINWORD.EXE
4648	WINWORD.EXE
4648	WINWORD.EXE
4648	WINWORD.EXE
4648	WINWORD.EXE

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4072	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	80
PID 4592 wrote to memory of 4072	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	80
PID 4592 wrote to memory of 4072	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	80
PID 4072 wrote to memory of 3056	4072	SVCHOST.EXE	81
PID 4072 wrote to memory of 3056	4072	SVCHOST.EXE	81
PID 4072 wrote to memory of 3056	4072	SVCHOST.EXE	81
PID 4072 wrote to memory of 5116	4072	SVCHOST.EXE	82
PID 4072 wrote to memory of 5116	4072	SVCHOST.EXE	82
PID 4072 wrote to memory of 5116	4072	SVCHOST.EXE	82
PID 5116 wrote to memory of 4360	5116	SPOOLSV.EXE	83
PID 5116 wrote to memory of 4360	5116	SPOOLSV.EXE	83
PID 5116 wrote to memory of 4360	5116	SPOOLSV.EXE	83
PID 5116 wrote to memory of 4984	5116	SPOOLSV.EXE	84
PID 5116 wrote to memory of 4984	5116	SPOOLSV.EXE	84
PID 5116 wrote to memory of 4984	5116	SPOOLSV.EXE	84
PID 5116 wrote to memory of 2040	5116	SPOOLSV.EXE	85
PID 5116 wrote to memory of 2040	5116	SPOOLSV.EXE	85
PID 5116 wrote to memory of 2040	5116	SPOOLSV.EXE	85
PID 2040 wrote to memory of 1124	2040	CTFMON.EXE	86
PID 2040 wrote to memory of 1124	2040	CTFMON.EXE	86
PID 2040 wrote to memory of 1124	2040	CTFMON.EXE	86
PID 2040 wrote to memory of 2332	2040	CTFMON.EXE	87
PID 2040 wrote to memory of 2332	2040	CTFMON.EXE	87
PID 2040 wrote to memory of 2332	2040	CTFMON.EXE	87
PID 2040 wrote to memory of 2616	2040	CTFMON.EXE	88
PID 2040 wrote to memory of 2616	2040	CTFMON.EXE	88
PID 2040 wrote to memory of 2616	2040	CTFMON.EXE	88
PID 4072 wrote to memory of 2808	4072	SVCHOST.EXE	89
PID 4072 wrote to memory of 2808	4072	SVCHOST.EXE	89
PID 4072 wrote to memory of 2808	4072	SVCHOST.EXE	89
PID 4592 wrote to memory of 240	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	90
PID 4592 wrote to memory of 240	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	90
PID 4592 wrote to memory of 240	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	90
PID 4072 wrote to memory of 1472	4072	SVCHOST.EXE	91
PID 4072 wrote to memory of 1472	4072	SVCHOST.EXE	91
PID 4072 wrote to memory of 1472	4072	SVCHOST.EXE	91
PID 4592 wrote to memory of 1536	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	92
PID 4592 wrote to memory of 1536	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	92
PID 4592 wrote to memory of 1536	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	92
PID 1472 wrote to memory of 4240	1472	userinit.exe	93
PID 1472 wrote to memory of 4240	1472	userinit.exe	93
PID 1472 wrote to memory of 4240	1472	userinit.exe	93
PID 4592 wrote to memory of 4648	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	100
PID 4592 wrote to memory of 4648	4592	dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe	100

C:\Users\Admin\AppData\Local\Temp\dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe
"C:\Users\Admin\AppData\Local\Temp\dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592
- C:\recycled\SVCHOST.EXE
  C:\recycled\SVCHOST.EXE :agent
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\recycled\SVCHOST.EXE
    C:\recycled\SVCHOST.EXE :agent
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3056
- - C:\recycled\SPOOLSV.EXE
    C:\recycled\SPOOLSV.EXE :agent
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4360
  - - C:\recycled\SPOOLSV.EXE
      C:\recycled\SPOOLSV.EXE :agent
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4984
  - - C:\recycled\CTFMON.EXE
      C:\recycled\CTFMON.EXE :agent
      4⤵
      Modifies WinLogon for persistence
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Enumerates connected drives
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2040
    - - C:\recycled\SVCHOST.EXE
        
        C:\recycled\SVCHOST.EXE :agent
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1124
    - - C:\recycled\SPOOLSV.EXE
        
        C:\recycled\SPOOLSV.EXE :agent
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
    - - C:\recycled\CTFMON.EXE
        
        C:\recycled\CTFMON.EXE :agent
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
- - C:\recycled\CTFMON.EXE
    C:\recycled\CTFMON.EXE :agent
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2808
- - C:\Windows\SysWOW64\userinit.exe
    C:\Windows\system32\userinit.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Windows\SysWOW64\Explorer.exe
      Explorer.exe "C:\recycled\SVCHOST.exe"
      4⤵
      PID:4240
- C:\recycled\SPOOLSV.EXE
  C:\recycled\SPOOLSV.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:240
- C:\recycled\CTFMON.EXE
  C:\recycled\CTFMON.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1536
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dab27d0b2235f29d526d4b12ba3c45141e944b621dec0da18fca9ad9475a2e7d.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:4648

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery