712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SPOOLSV.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe

Executes dropped EXE 15 IoCs

pid	Process
4940	SVCHOST.EXE
1220	SVCHOST.EXE
4776	SPOOLSV.EXE
4312	SVCHOST.EXE
3328	SPOOLSV.EXE
1644	CTFMON.EXE
2336	SVCHOST.EXE
3228	SPOOLSV.EXE
4400	CTFMON.EXE
3780	CTFMON.EXE
2596	SPOOLSV.EXE
4832	CTFMON.EXE
3748	SVCHOST.EXE
4880	SPOOLSV.EXE
4964	CTFMON.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Recycled\desktop.ini	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	SPOOLSV.EXE
File opened (read-only)	\??\G:	CTFMON.EXE
File opened (read-only)	\??\N:	CTFMON.EXE
File opened (read-only)	\??\G:	SVCHOST.EXE
File opened (read-only)	\??\J:	SVCHOST.EXE
File opened (read-only)	\??\G:	SPOOLSV.EXE
File opened (read-only)	\??\X:	SVCHOST.EXE
File opened (read-only)	\??\Q:	SPOOLSV.EXE
File opened (read-only)	\??\U:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\P:	SVCHOST.EXE
File opened (read-only)	\??\T:	SVCHOST.EXE
File opened (read-only)	\??\N:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\L:	SVCHOST.EXE
File opened (read-only)	\??\F:	CTFMON.EXE
File opened (read-only)	\??\E:	SVCHOST.EXE
File opened (read-only)	\??\H:	SVCHOST.EXE
File opened (read-only)	\??\U:	CTFMON.EXE
File opened (read-only)	\??\M:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\P:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\X:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\Y:	SVCHOST.EXE
File opened (read-only)	\??\O:	CTFMON.EXE
File opened (read-only)	\??\S:	CTFMON.EXE
File opened (read-only)	\??\Y:	CTFMON.EXE
File opened (read-only)	\??\K:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\Z:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\R:	SVCHOST.EXE
File opened (read-only)	\??\U:	SPOOLSV.EXE
File opened (read-only)	\??\K:	CTFMON.EXE
File opened (read-only)	\??\R:	CTFMON.EXE
File opened (read-only)	\??\J:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\W:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\K:	SPOOLSV.EXE
File opened (read-only)	\??\W:	SVCHOST.EXE
File opened (read-only)	\??\F:	SPOOLSV.EXE
File opened (read-only)	\??\N:	SPOOLSV.EXE
File opened (read-only)	\??\R:	SPOOLSV.EXE
File opened (read-only)	\??\I:	CTFMON.EXE
File opened (read-only)	\??\G:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\F:	SVCHOST.EXE
File opened (read-only)	\??\V:	SVCHOST.EXE
File opened (read-only)	\??\Y:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\O:	SPOOLSV.EXE
File opened (read-only)	\??\Q:	CTFMON.EXE
File opened (read-only)	\??\V:	CTFMON.EXE
File opened (read-only)	\??\X:	CTFMON.EXE
File opened (read-only)	\??\Z:	CTFMON.EXE
File opened (read-only)	\??\I:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\R:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\V:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\F:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\N:	SVCHOST.EXE
File opened (read-only)	\??\H:	CTFMON.EXE
File opened (read-only)	\??\W:	CTFMON.EXE
File opened (read-only)	\??\O:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\T:	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
File opened (read-only)	\??\M:	SVCHOST.EXE
File opened (read-only)	\??\Z:	SVCHOST.EXE
File opened (read-only)	\??\P:	SPOOLSV.EXE
File opened (read-only)	\??\E:	CTFMON.EXE
File opened (read-only)	\??\H:	SPOOLSV.EXE
File opened (read-only)	\??\M:	SPOOLSV.EXE
File opened (read-only)	\??\S:	SPOOLSV.EXE
File opened (read-only)	\??\W:	SPOOLSV.EXE

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Modifies registry class 29 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\TileInfo = "prop:Type;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	CTFMON.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\QuickTip = "prop:Type;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\QuickTip = "prop:Type;Size"	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\TileInfo = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\TileInfo = "prop:Type;Size"	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\QuickTip = "prop:Type;Size"	CTFMON.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SVCHOST.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\QuickTip = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\*\TileInfo = "prop:Type;Size"	CTFMON.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3588	WINWORD.EXE
3588	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
1644	CTFMON.EXE
1644	CTFMON.EXE
4776	SPOOLSV.EXE
4776	SPOOLSV.EXE
4940	SVCHOST.EXE
4940	SVCHOST.EXE
4940	SVCHOST.EXE
4940	SVCHOST.EXE

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
4940	SVCHOST.EXE
1220	SVCHOST.EXE
4776	SPOOLSV.EXE
4312	SVCHOST.EXE
3328	SPOOLSV.EXE
1644	CTFMON.EXE
2336	SVCHOST.EXE
3228	SPOOLSV.EXE
4400	CTFMON.EXE
3780	CTFMON.EXE
2596	SPOOLSV.EXE
4832	CTFMON.EXE
3748	SVCHOST.EXE
4880	SPOOLSV.EXE
4964	CTFMON.EXE
3588	WINWORD.EXE
3588	WINWORD.EXE
3588	WINWORD.EXE
3588	WINWORD.EXE
3588	WINWORD.EXE
3588	WINWORD.EXE
3588	WINWORD.EXE

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4940	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	79
PID 5076 wrote to memory of 4940	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	79
PID 5076 wrote to memory of 4940	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	79
PID 4940 wrote to memory of 1220	4940	SVCHOST.EXE	80
PID 4940 wrote to memory of 1220	4940	SVCHOST.EXE	80
PID 4940 wrote to memory of 1220	4940	SVCHOST.EXE	80
PID 4940 wrote to memory of 4776	4940	SVCHOST.EXE	81
PID 4940 wrote to memory of 4776	4940	SVCHOST.EXE	81
PID 4940 wrote to memory of 4776	4940	SVCHOST.EXE	81
PID 4776 wrote to memory of 4312	4776	SPOOLSV.EXE	82
PID 4776 wrote to memory of 4312	4776	SPOOLSV.EXE	82
PID 4776 wrote to memory of 4312	4776	SPOOLSV.EXE	82
PID 4776 wrote to memory of 3328	4776	SPOOLSV.EXE	83
PID 4776 wrote to memory of 3328	4776	SPOOLSV.EXE	83
PID 4776 wrote to memory of 3328	4776	SPOOLSV.EXE	83
PID 4776 wrote to memory of 1644	4776	SPOOLSV.EXE	84
PID 4776 wrote to memory of 1644	4776	SPOOLSV.EXE	84
PID 4776 wrote to memory of 1644	4776	SPOOLSV.EXE	84
PID 1644 wrote to memory of 2336	1644	CTFMON.EXE	85
PID 1644 wrote to memory of 2336	1644	CTFMON.EXE	85
PID 1644 wrote to memory of 2336	1644	CTFMON.EXE	85
PID 1644 wrote to memory of 3228	1644	CTFMON.EXE	86
PID 1644 wrote to memory of 3228	1644	CTFMON.EXE	86
PID 1644 wrote to memory of 3228	1644	CTFMON.EXE	86
PID 1644 wrote to memory of 4400	1644	CTFMON.EXE	87
PID 1644 wrote to memory of 4400	1644	CTFMON.EXE	87
PID 1644 wrote to memory of 4400	1644	CTFMON.EXE	87
PID 4940 wrote to memory of 3780	4940	SVCHOST.EXE	88
PID 4940 wrote to memory of 3780	4940	SVCHOST.EXE	88
PID 4940 wrote to memory of 3780	4940	SVCHOST.EXE	88
PID 5076 wrote to memory of 2596	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	89
PID 5076 wrote to memory of 2596	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	89
PID 5076 wrote to memory of 2596	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	89
PID 5076 wrote to memory of 4832	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	90
PID 5076 wrote to memory of 4832	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	90
PID 5076 wrote to memory of 4832	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	90
PID 5076 wrote to memory of 3748	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	91
PID 5076 wrote to memory of 3748	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	91
PID 5076 wrote to memory of 3748	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	91
PID 5076 wrote to memory of 4880	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	92
PID 5076 wrote to memory of 4880	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	92
PID 5076 wrote to memory of 4880	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	92
PID 5076 wrote to memory of 4964	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	93
PID 5076 wrote to memory of 4964	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	93
PID 5076 wrote to memory of 4964	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	93
PID 4940 wrote to memory of 4224	4940	SVCHOST.EXE	94
PID 4940 wrote to memory of 4224	4940	SVCHOST.EXE	94
PID 4940 wrote to memory of 4224	4940	SVCHOST.EXE	94
PID 4224 wrote to memory of 4812	4224	userinit.exe	95
PID 4224 wrote to memory of 4812	4224	userinit.exe	95
PID 4224 wrote to memory of 4812	4224	userinit.exe	95
PID 5076 wrote to memory of 3588	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	99
PID 5076 wrote to memory of 3588	5076	712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe	99

C:\Users\Admin\AppData\Local\Temp\712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe
"C:\Users\Admin\AppData\Local\Temp\712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076
- C:\recycled\SVCHOST.EXE
  C:\recycled\SVCHOST.EXE :agent
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\recycled\SVCHOST.EXE
    C:\recycled\SVCHOST.EXE :agent
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1220
- - C:\recycled\SPOOLSV.EXE
    C:\recycled\SPOOLSV.EXE :agent
    3⤵
    - Modifies WinLogon for persistence
    - Modifies visibility of file extensions in Explorer
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Enumerates connected drives
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4312
  - - C:\recycled\SPOOLSV.EXE
      C:\recycled\SPOOLSV.EXE :agent
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3328
  - - C:\recycled\CTFMON.EXE
      C:\recycled\CTFMON.EXE :agent
      4⤵
      Modifies WinLogon for persistence
      Modifies visibility of file extensions in Explorer
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Enumerates connected drives
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\recycled\SVCHOST.EXE
        
        C:\recycled\SVCHOST.EXE :agent
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2336
    - - C:\recycled\SPOOLSV.EXE
        
        C:\recycled\SPOOLSV.EXE :agent
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3228
    - - C:\recycled\CTFMON.EXE
        
        C:\recycled\CTFMON.EXE :agent
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
- - C:\recycled\CTFMON.EXE
    C:\recycled\CTFMON.EXE :agent
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3780
- - C:\Windows\SysWOW64\userinit.exe
    C:\Windows\system32\userinit.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\SysWOW64\Explorer.exe
      Explorer.exe "C:\recycled\SVCHOST.exe"
      4⤵
      PID:4812
- C:\recycled\SPOOLSV.EXE
  C:\recycled\SPOOLSV.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2596
- C:\recycled\CTFMON.EXE
  C:\recycled\CTFMON.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4832
- C:\recycled\SVCHOST.EXE
  C:\recycled\SVCHOST.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3748
- C:\recycled\SPOOLSV.EXE
  C:\recycled\SPOOLSV.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4880
- C:\recycled\CTFMON.EXE
  C:\recycled\CTFMON.EXE :agent
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4964
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\712d0774e1582309427ad83b79e74fd1fe04360e2c4711dd82c0ae52a4be9734.doc" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:3588

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery