4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475

Processes:

SVCHOST.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeCTFMON.EXESPOOLSV.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SVCHOST.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

Processes:

CTFMON.EXESPOOLSV.EXESVCHOST.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

Processes:

CTFMON.EXESPOOLSV.EXESVCHOST.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

Executes dropped EXE 12 IoCs

Processes:

SVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXE

pid	process
4404	SVCHOST.EXE
1548	SVCHOST.EXE
1344	SPOOLSV.EXE
3236	SVCHOST.EXE
1788	SPOOLSV.EXE
4920	CTFMON.EXE
4908	SVCHOST.EXE
2032	SPOOLSV.EXE
1104	CTFMON.EXE
972	CTFMON.EXE
1876	SPOOLSV.EXE
3388	CTFMON.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description ioc process

File opened for modification C:\Recycled\desktop.ini 4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description	ioc	process
File opened for modification	C:\Recycled\desktop.ini	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

SPOOLSV.EXECTFMON.EXESVCHOST.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description	ioc	process
File opened (read-only)	\??\Q:	SPOOLSV.EXE
File opened (read-only)	\??\U:	SPOOLSV.EXE
File opened (read-only)	\??\E:	CTFMON.EXE
File opened (read-only)	\??\G:	CTFMON.EXE
File opened (read-only)	\??\U:	SVCHOST.EXE
File opened (read-only)	\??\I:	SPOOLSV.EXE
File opened (read-only)	\??\X:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\P:	SVCHOST.EXE
File opened (read-only)	\??\X:	SVCHOST.EXE
File opened (read-only)	\??\E:	SPOOLSV.EXE
File opened (read-only)	\??\H:	CTFMON.EXE
File opened (read-only)	\??\J:	CTFMON.EXE
File opened (read-only)	\??\M:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\O:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\O:	CTFMON.EXE
File opened (read-only)	\??\Z:	CTFMON.EXE
File opened (read-only)	\??\R:	SPOOLSV.EXE
File opened (read-only)	\??\W:	SPOOLSV.EXE
File opened (read-only)	\??\Q:	CTFMON.EXE
File opened (read-only)	\??\R:	CTFMON.EXE
File opened (read-only)	\??\Y:	CTFMON.EXE
File opened (read-only)	\??\M:	SVCHOST.EXE
File opened (read-only)	\??\Y:	SVCHOST.EXE
File opened (read-only)	\??\V:	SVCHOST.EXE
File opened (read-only)	\??\P:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\K:	SVCHOST.EXE
File opened (read-only)	\??\N:	SPOOLSV.EXE
File opened (read-only)	\??\U:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\J:	SVCHOST.EXE
File opened (read-only)	\??\P:	CTFMON.EXE
File opened (read-only)	\??\L:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\G:	SPOOLSV.EXE
File opened (read-only)	\??\K:	CTFMON.EXE
File opened (read-only)	\??\S:	SPOOLSV.EXE
File opened (read-only)	\??\Z:	SPOOLSV.EXE
File opened (read-only)	\??\K:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\Z:	SVCHOST.EXE
File opened (read-only)	\??\O:	SPOOLSV.EXE
File opened (read-only)	\??\V:	SPOOLSV.EXE
File opened (read-only)	\??\E:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\F:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\H:	SVCHOST.EXE
File opened (read-only)	\??\I:	SVCHOST.EXE
File opened (read-only)	\??\W:	SVCHOST.EXE
File opened (read-only)	\??\K:	SPOOLSV.EXE
File opened (read-only)	\??\I:	CTFMON.EXE
File opened (read-only)	\??\M:	CTFMON.EXE
File opened (read-only)	\??\Q:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\V:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\Q:	SVCHOST.EXE
File opened (read-only)	\??\R:	SVCHOST.EXE
File opened (read-only)	\??\W:	CTFMON.EXE
File opened (read-only)	\??\N:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\S:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\T:	SVCHOST.EXE
File opened (read-only)	\??\P:	SPOOLSV.EXE
File opened (read-only)	\??\T:	SPOOLSV.EXE
File opened (read-only)	\??\L:	CTFMON.EXE
File opened (read-only)	\??\V:	CTFMON.EXE
File opened (read-only)	\??\I:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\O:	SVCHOST.EXE
File opened (read-only)	\??\Y:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\F:	SVCHOST.EXE
File opened (read-only)	\??\S:	SVCHOST.EXE

Drops file in Program Files directory 1 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 29 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeSPOOLSV.EXECTFMON.EXESVCHOST.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\QuickTip = "prop:Type;Size"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\TileInfo = "prop:Type;Size"	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	CTFMON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\QuickTip = "prop:Type;Size"	SPOOLSV.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\TileInfo = "prop:Type;Size"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\QuickTip = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\TileInfo = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\TileInfo = "prop:Type;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\*\QuickTip = "prop:Type;Size"	CTFMON.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2932 WINWORD.EXE
2932 WINWORD.EXE

pid	process
2932	WINWORD.EXE
2932	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

CTFMON.EXESPOOLSV.EXESVCHOST.EXE

pid	process
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
1344	SPOOLSV.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4404	SVCHOST.EXE
4404	SVCHOST.EXE
4920	CTFMON.EXE
4920	CTFMON.EXE
4404	SVCHOST.EXE
4920	CTFMON.EXE

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeSVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXEWINWORD.EXE

pid	process
1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
4404	SVCHOST.EXE
1548	SVCHOST.EXE
1344	SPOOLSV.EXE
3236	SVCHOST.EXE
1788	SPOOLSV.EXE
4920	CTFMON.EXE
4908	SVCHOST.EXE
2032	SPOOLSV.EXE
1104	CTFMON.EXE
972	CTFMON.EXE
1876	SPOOLSV.EXE
3388	CTFMON.EXE
2932	WINWORD.EXE
2932	WINWORD.EXE
2932	WINWORD.EXE
2932	WINWORD.EXE
2932	WINWORD.EXE
2932	WINWORD.EXE
2932	WINWORD.EXE

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeSVCHOST.EXESPOOLSV.EXECTFMON.EXEuserinit.exe

description	pid	process	target process
PID 1404 wrote to memory of 4404	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SVCHOST.EXE
PID 1404 wrote to memory of 4404	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SVCHOST.EXE
PID 1404 wrote to memory of 4404	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SVCHOST.EXE
PID 4404 wrote to memory of 1548	4404	SVCHOST.EXE	SVCHOST.EXE
PID 4404 wrote to memory of 1548	4404	SVCHOST.EXE	SVCHOST.EXE
PID 4404 wrote to memory of 1548	4404	SVCHOST.EXE	SVCHOST.EXE
PID 4404 wrote to memory of 1344	4404	SVCHOST.EXE	SPOOLSV.EXE
PID 4404 wrote to memory of 1344	4404	SVCHOST.EXE	SPOOLSV.EXE
PID 4404 wrote to memory of 1344	4404	SVCHOST.EXE	SPOOLSV.EXE
PID 1344 wrote to memory of 3236	1344	SPOOLSV.EXE	SVCHOST.EXE
PID 1344 wrote to memory of 3236	1344	SPOOLSV.EXE	SVCHOST.EXE
PID 1344 wrote to memory of 3236	1344	SPOOLSV.EXE	SVCHOST.EXE
PID 1344 wrote to memory of 1788	1344	SPOOLSV.EXE	SPOOLSV.EXE
PID 1344 wrote to memory of 1788	1344	SPOOLSV.EXE	SPOOLSV.EXE
PID 1344 wrote to memory of 1788	1344	SPOOLSV.EXE	SPOOLSV.EXE
PID 1344 wrote to memory of 4920	1344	SPOOLSV.EXE	CTFMON.EXE
PID 1344 wrote to memory of 4920	1344	SPOOLSV.EXE	CTFMON.EXE
PID 1344 wrote to memory of 4920	1344	SPOOLSV.EXE	CTFMON.EXE
PID 4920 wrote to memory of 4908	4920	CTFMON.EXE	SVCHOST.EXE
PID 4920 wrote to memory of 4908	4920	CTFMON.EXE	SVCHOST.EXE
PID 4920 wrote to memory of 4908	4920	CTFMON.EXE	SVCHOST.EXE
PID 4920 wrote to memory of 2032	4920	CTFMON.EXE	SPOOLSV.EXE
PID 4920 wrote to memory of 2032	4920	CTFMON.EXE	SPOOLSV.EXE
PID 4920 wrote to memory of 2032	4920	CTFMON.EXE	SPOOLSV.EXE
PID 4920 wrote to memory of 1104	4920	CTFMON.EXE	CTFMON.EXE
PID 4920 wrote to memory of 1104	4920	CTFMON.EXE	CTFMON.EXE
PID 4920 wrote to memory of 1104	4920	CTFMON.EXE	CTFMON.EXE
PID 4404 wrote to memory of 972	4404	SVCHOST.EXE	CTFMON.EXE
PID 4404 wrote to memory of 972	4404	SVCHOST.EXE	CTFMON.EXE
PID 4404 wrote to memory of 972	4404	SVCHOST.EXE	CTFMON.EXE
PID 1404 wrote to memory of 1876	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SPOOLSV.EXE
PID 1404 wrote to memory of 1876	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SPOOLSV.EXE
PID 1404 wrote to memory of 1876	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SPOOLSV.EXE
PID 4404 wrote to memory of 3204	4404	SVCHOST.EXE	userinit.exe
PID 4404 wrote to memory of 3204	4404	SVCHOST.EXE	userinit.exe
PID 4404 wrote to memory of 3204	4404	SVCHOST.EXE	userinit.exe
PID 1404 wrote to memory of 3388	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	CTFMON.EXE
PID 1404 wrote to memory of 3388	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	CTFMON.EXE
PID 1404 wrote to memory of 3388	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	CTFMON.EXE
PID 3204 wrote to memory of 3488	3204	userinit.exe	Explorer.exe
PID 3204 wrote to memory of 3488	3204	userinit.exe	Explorer.exe
PID 3204 wrote to memory of 3488	3204	userinit.exe	Explorer.exe
PID 1404 wrote to memory of 2932	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	WINWORD.EXE
PID 1404 wrote to memory of 2932	1404	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
"C:\Users\Admin\AppData\Local\Temp\4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1344

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3236

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1788

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4908

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2032

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1104

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:972

C:\Windows\SysWOW64\userinit.exe
C:\Windows\system32\userinit.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3204

C:\Windows\SysWOW64\Explorer.exe
Explorer.exe "C:\recycled\SVCHOST.exe"
4⤵
PID:3488

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1876

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3388

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.doc" /o ""
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2932

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

Credential Access

Discovery

Query Registry

System Information Discovery