d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5

Analysis

max time kernel
185s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
Size

42KB
MD5

76fc6dd56b4f8ddc559c77036b76b937
SHA1

3e37d7bc9420c4fdde2d907d8d1ca1196e934bf1
SHA256

d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5
SHA512

4a6213f0ddbaeb68a7b17516ed51d52e8434ec91102a6023396c468c4c6cd50acc8adf02e3f172bf6ae22d478bf9161bbbc0aea02ab68b9c505b5fe7bdbfeef6
SSDEEP

768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888s:BzOCay4wV339rPjzbpLwRJ9pSdoI1

Score

10^/10

aspackv2 evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

SVCHOST.EXEd2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exeCTFMON.EXESPOOLSV.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	SVCHOST.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

CTFMON.EXESPOOLSV.EXESVCHOST.EXEd2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

CTFMON.EXESPOOLSV.EXESVCHOST.EXEd2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

ASPack v2.12-2.42 33 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Recycled\SVCHOST.EXE	aspack_v212_v242
\Recycled\SVCHOST.EXE	aspack_v212_v242
C:\Recycled\SVCHOST.EXE	aspack_v212_v242
C:\Windows\Fonts\ Explorer.exe	aspack_v212_v242
C:\recycled\SVCHOST.exe	aspack_v212_v242
C:\Recycled\SVCHOST.EXE	aspack_v212_v242
\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\recycled\SPOOLSV.EXE	aspack_v212_v242
\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Recycled\SPOOLSV.EXE	aspack_v212_v242
\Recycled\SVCHOST.EXE	aspack_v212_v242
C:\Windows\Fonts\ Explorer.exe	aspack_v212_v242
C:\Recycled\SVCHOST.EXE	aspack_v212_v242
\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Recycled\SPOOLSV.EXE	aspack_v212_v242
\Recycled\CTFMON.EXE	aspack_v212_v242
C:\recycled\CTFMON.EXE	aspack_v212_v242
C:\Recycled\CTFMON.EXE	aspack_v212_v242
\Recycled\CTFMON.EXE	aspack_v212_v242
C:\Windows\Fonts\ Explorer.exe	aspack_v212_v242
\Recycled\SVCHOST.EXE	aspack_v212_v242
C:\Recycled\SVCHOST.EXE	aspack_v212_v242
\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Recycled\SPOOLSV.EXE	aspack_v212_v242
\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Recycled\CTFMON.EXE	aspack_v212_v242
\Recycled\CTFMON.EXE	aspack_v212_v242
C:\Recycled\CTFMON.EXE	aspack_v212_v242
\Recycled\SPOOLSV.EXE	aspack_v212_v242
\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Recycled\SPOOLSV.EXE	aspack_v212_v242
\Recycled\CTFMON.EXE	aspack_v212_v242
C:\Recycled\CTFMON.EXE	aspack_v212_v242

Executes dropped EXE 12 IoCs

Processes:

SVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXE

pid	process
1920	SVCHOST.EXE
524	SVCHOST.EXE
1476	SPOOLSV.EXE
1308	SVCHOST.EXE
1824	SPOOLSV.EXE
1748	CTFMON.EXE
1552	SVCHOST.EXE
1828	SPOOLSV.EXE
1892	CTFMON.EXE
944	CTFMON.EXE
1168	SPOOLSV.EXE
1352	CTFMON.EXE

Loads dropped DLL 15 IoCs

Processes:

d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exeSVCHOST.EXESPOOLSV.EXECTFMON.EXE

pid	process
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1920	SVCHOST.EXE
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

description ioc process

File opened for modification C:\Recycled\desktop.ini d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

description	ioc	process
File opened for modification	C:\Recycled\desktop.ini	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

CTFMON.EXEd2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exeSVCHOST.EXESPOOLSV.EXE

description	ioc	process
File opened (read-only)	\??\H:	CTFMON.EXE
File opened (read-only)	\??\T:	CTFMON.EXE
File opened (read-only)	\??\E:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\T:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\U:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\W:	SVCHOST.EXE
File opened (read-only)	\??\P:	SPOOLSV.EXE
File opened (read-only)	\??\G:	CTFMON.EXE
File opened (read-only)	\??\I:	SVCHOST.EXE
File opened (read-only)	\??\N:	SVCHOST.EXE
File opened (read-only)	\??\R:	SPOOLSV.EXE
File opened (read-only)	\??\U:	SPOOLSV.EXE
File opened (read-only)	\??\Y:	SPOOLSV.EXE
File opened (read-only)	\??\Q:	CTFMON.EXE
File opened (read-only)	\??\P:	SVCHOST.EXE
File opened (read-only)	\??\U:	SVCHOST.EXE
File opened (read-only)	\??\T:	SPOOLSV.EXE
File opened (read-only)	\??\J:	CTFMON.EXE
File opened (read-only)	\??\P:	CTFMON.EXE
File opened (read-only)	\??\Q:	SVCHOST.EXE
File opened (read-only)	\??\E:	SPOOLSV.EXE
File opened (read-only)	\??\V:	SPOOLSV.EXE
File opened (read-only)	\??\N:	CTFMON.EXE
File opened (read-only)	\??\E:	SVCHOST.EXE
File opened (read-only)	\??\L:	SPOOLSV.EXE
File opened (read-only)	\??\S:	SPOOLSV.EXE
File opened (read-only)	\??\I:	CTFMON.EXE
File opened (read-only)	\??\L:	CTFMON.EXE
File opened (read-only)	\??\X:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\O:	CTFMON.EXE
File opened (read-only)	\??\F:	SVCHOST.EXE
File opened (read-only)	\??\J:	SVCHOST.EXE
File opened (read-only)	\??\S:	SVCHOST.EXE
File opened (read-only)	\??\L:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\M:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\O:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\W:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\Y:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\I:	SPOOLSV.EXE
File opened (read-only)	\??\J:	SPOOLSV.EXE
File opened (read-only)	\??\Z:	SPOOLSV.EXE
File opened (read-only)	\??\U:	CTFMON.EXE
File opened (read-only)	\??\G:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\Z:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\Y:	SVCHOST.EXE
File opened (read-only)	\??\F:	CTFMON.EXE
File opened (read-only)	\??\V:	SVCHOST.EXE
File opened (read-only)	\??\Z:	SVCHOST.EXE
File opened (read-only)	\??\G:	SPOOLSV.EXE
File opened (read-only)	\??\H:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\J:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\R:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\H:	SVCHOST.EXE
File opened (read-only)	\??\O:	SVCHOST.EXE
File opened (read-only)	\??\M:	SPOOLSV.EXE
File opened (read-only)	\??\X:	SPOOLSV.EXE
File opened (read-only)	\??\K:	CTFMON.EXE
File opened (read-only)	\??\W:	CTFMON.EXE
File opened (read-only)	\??\Q:	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened (read-only)	\??\N:	SPOOLSV.EXE
File opened (read-only)	\??\S:	CTFMON.EXE
File opened (read-only)	\??\Y:	CTFMON.EXE
File opened (read-only)	\??\R:	SVCHOST.EXE
File opened (read-only)	\??\O:	SPOOLSV.EXE

Drops file in Windows directory 6 IoCs

Processes:

CTFMON.EXEWINWORD.EXEd2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exeSVCHOST.EXESPOOLSV.EXE

description	ioc	process
File opened for modification	C:\Windows\Fonts\ Explorer.exe	CTFMON.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\Fonts\ Explorer.exe	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
File opened for modification	C:\Windows\Fonts\ Explorer.exe	SVCHOST.EXE
File opened for modification	C:\Windows\Fonts\ Explorer.exe	SPOOLSV.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXESVCHOST.EXECTFMON.EXEd2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exeSPOOLSV.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size"	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	CTFMON.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe"	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SPOOLSV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size"	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL\COMMAND	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1560 WINWORD.EXE

pid	process
1560	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

SPOOLSV.EXESVCHOST.EXECTFMON.EXEd2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe

pid	process
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1748	CTFMON.EXE
1476	SPOOLSV.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1476	SPOOLSV.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1920	SVCHOST.EXE
1748	CTFMON.EXE
1748	CTFMON.EXE
1920	SVCHOST.EXE
1476	SPOOLSV.EXE
1920	SVCHOST.EXE
1476	SPOOLSV.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1920	SVCHOST.EXE
1920	SVCHOST.EXE
1476	SPOOLSV.EXE
1476	SPOOLSV.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1560 WINWORD.EXE
1560 WINWORD.EXE

pid	process
1560	WINWORD.EXE
1560	WINWORD.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exeSVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXEWINWORD.EXE

pid	process
1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
1920	SVCHOST.EXE
524	SVCHOST.EXE
1476	SPOOLSV.EXE
1308	SVCHOST.EXE
1824	SPOOLSV.EXE
1748	CTFMON.EXE
1552	SVCHOST.EXE
1828	SPOOLSV.EXE
1892	CTFMON.EXE
944	CTFMON.EXE
1168	SPOOLSV.EXE
1352	CTFMON.EXE
1560	WINWORD.EXE
1560	WINWORD.EXE

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exeSVCHOST.EXESPOOLSV.EXECTFMON.EXEWINWORD.EXE

description	pid	process	target process
PID 1776 wrote to memory of 1920	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	SVCHOST.EXE
PID 1776 wrote to memory of 1920	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	SVCHOST.EXE
PID 1776 wrote to memory of 1920	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	SVCHOST.EXE
PID 1776 wrote to memory of 1920	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	SVCHOST.EXE
PID 1920 wrote to memory of 524	1920	SVCHOST.EXE	SVCHOST.EXE
PID 1920 wrote to memory of 524	1920	SVCHOST.EXE	SVCHOST.EXE
PID 1920 wrote to memory of 524	1920	SVCHOST.EXE	SVCHOST.EXE
PID 1920 wrote to memory of 524	1920	SVCHOST.EXE	SVCHOST.EXE
PID 1920 wrote to memory of 1476	1920	SVCHOST.EXE	SPOOLSV.EXE
PID 1920 wrote to memory of 1476	1920	SVCHOST.EXE	SPOOLSV.EXE
PID 1920 wrote to memory of 1476	1920	SVCHOST.EXE	SPOOLSV.EXE
PID 1920 wrote to memory of 1476	1920	SVCHOST.EXE	SPOOLSV.EXE
PID 1476 wrote to memory of 1308	1476	SPOOLSV.EXE	SVCHOST.EXE
PID 1476 wrote to memory of 1308	1476	SPOOLSV.EXE	SVCHOST.EXE
PID 1476 wrote to memory of 1308	1476	SPOOLSV.EXE	SVCHOST.EXE
PID 1476 wrote to memory of 1308	1476	SPOOLSV.EXE	SVCHOST.EXE
PID 1476 wrote to memory of 1824	1476	SPOOLSV.EXE	SPOOLSV.EXE
PID 1476 wrote to memory of 1824	1476	SPOOLSV.EXE	SPOOLSV.EXE
PID 1476 wrote to memory of 1824	1476	SPOOLSV.EXE	SPOOLSV.EXE
PID 1476 wrote to memory of 1824	1476	SPOOLSV.EXE	SPOOLSV.EXE
PID 1476 wrote to memory of 1748	1476	SPOOLSV.EXE	CTFMON.EXE
PID 1476 wrote to memory of 1748	1476	SPOOLSV.EXE	CTFMON.EXE
PID 1476 wrote to memory of 1748	1476	SPOOLSV.EXE	CTFMON.EXE
PID 1476 wrote to memory of 1748	1476	SPOOLSV.EXE	CTFMON.EXE
PID 1748 wrote to memory of 1552	1748	CTFMON.EXE	SVCHOST.EXE
PID 1748 wrote to memory of 1552	1748	CTFMON.EXE	SVCHOST.EXE
PID 1748 wrote to memory of 1552	1748	CTFMON.EXE	SVCHOST.EXE
PID 1748 wrote to memory of 1552	1748	CTFMON.EXE	SVCHOST.EXE
PID 1748 wrote to memory of 1828	1748	CTFMON.EXE	SPOOLSV.EXE
PID 1748 wrote to memory of 1828	1748	CTFMON.EXE	SPOOLSV.EXE
PID 1748 wrote to memory of 1828	1748	CTFMON.EXE	SPOOLSV.EXE
PID 1748 wrote to memory of 1828	1748	CTFMON.EXE	SPOOLSV.EXE
PID 1748 wrote to memory of 1892	1748	CTFMON.EXE	CTFMON.EXE
PID 1748 wrote to memory of 1892	1748	CTFMON.EXE	CTFMON.EXE
PID 1748 wrote to memory of 1892	1748	CTFMON.EXE	CTFMON.EXE
PID 1748 wrote to memory of 1892	1748	CTFMON.EXE	CTFMON.EXE
PID 1920 wrote to memory of 944	1920	SVCHOST.EXE	CTFMON.EXE
PID 1920 wrote to memory of 944	1920	SVCHOST.EXE	CTFMON.EXE
PID 1920 wrote to memory of 944	1920	SVCHOST.EXE	CTFMON.EXE
PID 1920 wrote to memory of 944	1920	SVCHOST.EXE	CTFMON.EXE
PID 1776 wrote to memory of 1168	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	SPOOLSV.EXE
PID 1776 wrote to memory of 1168	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	SPOOLSV.EXE
PID 1776 wrote to memory of 1168	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	SPOOLSV.EXE
PID 1776 wrote to memory of 1168	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	SPOOLSV.EXE
PID 1776 wrote to memory of 1352	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	CTFMON.EXE
PID 1776 wrote to memory of 1352	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	CTFMON.EXE
PID 1776 wrote to memory of 1352	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	CTFMON.EXE
PID 1776 wrote to memory of 1352	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	CTFMON.EXE
PID 1776 wrote to memory of 1560	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	WINWORD.EXE
PID 1776 wrote to memory of 1560	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	WINWORD.EXE
PID 1776 wrote to memory of 1560	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	WINWORD.EXE
PID 1776 wrote to memory of 1560	1776	d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe	WINWORD.EXE
PID 1560 wrote to memory of 1752	1560	WINWORD.EXE	splwow64.exe
PID 1560 wrote to memory of 1752	1560	WINWORD.EXE	splwow64.exe
PID 1560 wrote to memory of 1752	1560	WINWORD.EXE	splwow64.exe
PID 1560 wrote to memory of 1752	1560	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe
"C:\Users\Admin\AppData\Local\Temp\d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:524

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1824

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1552

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1828

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1892

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:944

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1168

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1352

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d2f50eee8786568c10f8e604ffdcd8441187a630d6eb6e79f999c35ceaf84dc5.doc"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:1752

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recycled\CTFMON.EXE
Filesize
42KB

MD5
4f7d1d859c9af6619cba88849caac209

SHA1
840c9a51b2e9304e15ef376d1c5278d018980c00

SHA256
702fd3ff81b577d0c27529badf754c7ea270d8f86650ec8ca57fefae3f9ff5e6

SHA512
7cc76407701f22570b8745d1a444dd244b0fda57c7865bac14bfcb17ca87d84416cde164149057e34259ff91e0e942dc5ce5c81d518ad63a778ed68452a13ef9

Download Submit
C:\Recycled\CTFMON.EXE
Filesize
42KB

MD5
4f7d1d859c9af6619cba88849caac209

SHA1
840c9a51b2e9304e15ef376d1c5278d018980c00

SHA256
702fd3ff81b577d0c27529badf754c7ea270d8f86650ec8ca57fefae3f9ff5e6

SHA512
7cc76407701f22570b8745d1a444dd244b0fda57c7865bac14bfcb17ca87d84416cde164149057e34259ff91e0e942dc5ce5c81d518ad63a778ed68452a13ef9

Download Submit
C:\Recycled\CTFMON.EXE
Filesize
42KB

MD5
4f7d1d859c9af6619cba88849caac209

SHA1
840c9a51b2e9304e15ef376d1c5278d018980c00

SHA256
702fd3ff81b577d0c27529badf754c7ea270d8f86650ec8ca57fefae3f9ff5e6

SHA512
7cc76407701f22570b8745d1a444dd244b0fda57c7865bac14bfcb17ca87d84416cde164149057e34259ff91e0e942dc5ce5c81d518ad63a778ed68452a13ef9

Download Submit
C:\Recycled\CTFMON.EXE
Filesize
42KB

MD5
4f7d1d859c9af6619cba88849caac209

SHA1
840c9a51b2e9304e15ef376d1c5278d018980c00

SHA256
702fd3ff81b577d0c27529badf754c7ea270d8f86650ec8ca57fefae3f9ff5e6

SHA512
7cc76407701f22570b8745d1a444dd244b0fda57c7865bac14bfcb17ca87d84416cde164149057e34259ff91e0e942dc5ce5c81d518ad63a778ed68452a13ef9

Download Submit
C:\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
C:\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
C:\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
C:\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
C:\Recycled\SVCHOST.EXE
Filesize
42KB

MD5
7b7ec509bb76d8aebc5122f935c2e219

SHA1
6e9bc488f9ded6d6e1a98304925eb3556a969a06

SHA256
de737f4127f063bafa7b7878d27079919a200b0974298ee59778659803a5144e

SHA512
9987fe9e46bf9879e2371689cd839f533acd85b3c405050234b3fe501bd005d1734ecb2aecb7c1576ed5c8f7cea7489da95582a13cb5c4161c6ab5cf9bc9470b

Download Submit
C:\Recycled\SVCHOST.EXE
Filesize
42KB

MD5
7b7ec509bb76d8aebc5122f935c2e219

SHA1
6e9bc488f9ded6d6e1a98304925eb3556a969a06

SHA256
de737f4127f063bafa7b7878d27079919a200b0974298ee59778659803a5144e

SHA512
9987fe9e46bf9879e2371689cd839f533acd85b3c405050234b3fe501bd005d1734ecb2aecb7c1576ed5c8f7cea7489da95582a13cb5c4161c6ab5cf9bc9470b

Download Submit
C:\Recycled\SVCHOST.EXE
Filesize
42KB

MD5
7b7ec509bb76d8aebc5122f935c2e219

SHA1
6e9bc488f9ded6d6e1a98304925eb3556a969a06

SHA256
de737f4127f063bafa7b7878d27079919a200b0974298ee59778659803a5144e

SHA512
9987fe9e46bf9879e2371689cd839f533acd85b3c405050234b3fe501bd005d1734ecb2aecb7c1576ed5c8f7cea7489da95582a13cb5c4161c6ab5cf9bc9470b

Download Submit
C:\Recycled\SVCHOST.EXE
Filesize
42KB

MD5
7b7ec509bb76d8aebc5122f935c2e219

SHA1
6e9bc488f9ded6d6e1a98304925eb3556a969a06

SHA256
de737f4127f063bafa7b7878d27079919a200b0974298ee59778659803a5144e

SHA512
9987fe9e46bf9879e2371689cd839f533acd85b3c405050234b3fe501bd005d1734ecb2aecb7c1576ed5c8f7cea7489da95582a13cb5c4161c6ab5cf9bc9470b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
Filesize
2KB

MD5
1a1dce35d60d2c70ca8894954fd5d384

SHA1
58547dd65d506c892290755010d0232da34ee000

SHA256
2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c

SHA512
4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
Filesize
2KB

MD5
1a1dce35d60d2c70ca8894954fd5d384

SHA1
58547dd65d506c892290755010d0232da34ee000

SHA256
2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c

SHA512
4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
Filesize
2KB

MD5
1a1dce35d60d2c70ca8894954fd5d384

SHA1
58547dd65d506c892290755010d0232da34ee000

SHA256
2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c

SHA512
4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e

Download Submit
C:\Windows\Fonts\ Explorer.exe
Filesize
42KB

MD5
609cdbe03c126f29af33d8bffdf6e0c8

SHA1
15a7e369b17f2fea76763236c5a162f11ceb7c2c

SHA256
1ae0dec8d06b594778f811f32f42151a344737466f3f0e611fc0c0b3f03f8777

SHA512
f890d12afe520851b41595ec6ef4631adb01f794b71980895bf94d277268c8f283b1029153ec49a4811a0ee765feef274c3bd8363d3f5133e4757f2b319d288c

Download Submit
C:\Windows\Fonts\ Explorer.exe
Filesize
42KB

MD5
72070e980b29f6cb18b973f00ace5610

SHA1
67bf2462521f09b9a136fe549f52065517128bed

SHA256
700dcb266098b3236a7410a5fbfdeddfc90166737dfa61184734a33feed89c36

SHA512
0b102452c90dcdcd8f27ed754fcb23b32b6cdf900a1b864f69dec040adb36859241dc100253c801248c468670824bc0f39869473fc5e52dba8aa834af91f9bf5

Download Submit
C:\Windows\Fonts\ Explorer.exe
Filesize
42KB

MD5
609cdbe03c126f29af33d8bffdf6e0c8

SHA1
15a7e369b17f2fea76763236c5a162f11ceb7c2c

SHA256
1ae0dec8d06b594778f811f32f42151a344737466f3f0e611fc0c0b3f03f8777

SHA512
f890d12afe520851b41595ec6ef4631adb01f794b71980895bf94d277268c8f283b1029153ec49a4811a0ee765feef274c3bd8363d3f5133e4757f2b319d288c

Download Submit
C:\recycled\CTFMON.EXE
Filesize
42KB

MD5
4f7d1d859c9af6619cba88849caac209

SHA1
840c9a51b2e9304e15ef376d1c5278d018980c00

SHA256
702fd3ff81b577d0c27529badf754c7ea270d8f86650ec8ca57fefae3f9ff5e6

SHA512
7cc76407701f22570b8745d1a444dd244b0fda57c7865bac14bfcb17ca87d84416cde164149057e34259ff91e0e942dc5ce5c81d518ad63a778ed68452a13ef9

Download Submit
C:\recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
C:\recycled\SVCHOST.exe
Filesize
42KB

MD5
7b7ec509bb76d8aebc5122f935c2e219

SHA1
6e9bc488f9ded6d6e1a98304925eb3556a969a06

SHA256
de737f4127f063bafa7b7878d27079919a200b0974298ee59778659803a5144e

SHA512
9987fe9e46bf9879e2371689cd839f533acd85b3c405050234b3fe501bd005d1734ecb2aecb7c1576ed5c8f7cea7489da95582a13cb5c4161c6ab5cf9bc9470b

Download Submit
\Recycled\CTFMON.EXE
Filesize
42KB

MD5
4f7d1d859c9af6619cba88849caac209

SHA1
840c9a51b2e9304e15ef376d1c5278d018980c00

SHA256
702fd3ff81b577d0c27529badf754c7ea270d8f86650ec8ca57fefae3f9ff5e6

SHA512
7cc76407701f22570b8745d1a444dd244b0fda57c7865bac14bfcb17ca87d84416cde164149057e34259ff91e0e942dc5ce5c81d518ad63a778ed68452a13ef9

Download Submit
\Recycled\CTFMON.EXE
Filesize
42KB

MD5
4f7d1d859c9af6619cba88849caac209

SHA1
840c9a51b2e9304e15ef376d1c5278d018980c00

SHA256
702fd3ff81b577d0c27529badf754c7ea270d8f86650ec8ca57fefae3f9ff5e6

SHA512
7cc76407701f22570b8745d1a444dd244b0fda57c7865bac14bfcb17ca87d84416cde164149057e34259ff91e0e942dc5ce5c81d518ad63a778ed68452a13ef9

Download Submit
\Recycled\CTFMON.EXE
Filesize
42KB

MD5
4f7d1d859c9af6619cba88849caac209

SHA1
840c9a51b2e9304e15ef376d1c5278d018980c00

SHA256
702fd3ff81b577d0c27529badf754c7ea270d8f86650ec8ca57fefae3f9ff5e6

SHA512
7cc76407701f22570b8745d1a444dd244b0fda57c7865bac14bfcb17ca87d84416cde164149057e34259ff91e0e942dc5ce5c81d518ad63a778ed68452a13ef9

Download Submit
\Recycled\CTFMON.EXE
Filesize
42KB

MD5
4f7d1d859c9af6619cba88849caac209

SHA1
840c9a51b2e9304e15ef376d1c5278d018980c00

SHA256
702fd3ff81b577d0c27529badf754c7ea270d8f86650ec8ca57fefae3f9ff5e6

SHA512
7cc76407701f22570b8745d1a444dd244b0fda57c7865bac14bfcb17ca87d84416cde164149057e34259ff91e0e942dc5ce5c81d518ad63a778ed68452a13ef9

Download Submit
\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
\Recycled\SPOOLSV.EXE
Filesize
42KB

MD5
c4dac6cf169bc3cdc0a177ffd0bc5816

SHA1
9f9da185102b2adf4f2dad44108278f9fb92a051

SHA256
83141609567808fe305e734e3cd5ace23f99a4f558f96e1fed9d1d0dca0b8d42

SHA512
2978cd7421ede3f4dd7cc7a726a4ec6919f278df837c2c3b180e0c7f0da6b4ee6496e1f4e54c9cf1a78c88d783a205ec62e1a4581ea374b4dfc91cf5766e192a

Download Submit
\Recycled\SVCHOST.EXE
Filesize
42KB

MD5
7b7ec509bb76d8aebc5122f935c2e219

SHA1
6e9bc488f9ded6d6e1a98304925eb3556a969a06

SHA256
de737f4127f063bafa7b7878d27079919a200b0974298ee59778659803a5144e

SHA512
9987fe9e46bf9879e2371689cd839f533acd85b3c405050234b3fe501bd005d1734ecb2aecb7c1576ed5c8f7cea7489da95582a13cb5c4161c6ab5cf9bc9470b

Download Submit
\Recycled\SVCHOST.EXE
Filesize
42KB

MD5
7b7ec509bb76d8aebc5122f935c2e219

SHA1
6e9bc488f9ded6d6e1a98304925eb3556a969a06

SHA256
de737f4127f063bafa7b7878d27079919a200b0974298ee59778659803a5144e

SHA512
9987fe9e46bf9879e2371689cd839f533acd85b3c405050234b3fe501bd005d1734ecb2aecb7c1576ed5c8f7cea7489da95582a13cb5c4161c6ab5cf9bc9470b

Download Submit
\Recycled\SVCHOST.EXE
Filesize
42KB

MD5
7b7ec509bb76d8aebc5122f935c2e219

SHA1
6e9bc488f9ded6d6e1a98304925eb3556a969a06

SHA256
de737f4127f063bafa7b7878d27079919a200b0974298ee59778659803a5144e

SHA512
9987fe9e46bf9879e2371689cd839f533acd85b3c405050234b3fe501bd005d1734ecb2aecb7c1576ed5c8f7cea7489da95582a13cb5c4161c6ab5cf9bc9470b

Download Submit
\Recycled\SVCHOST.EXE
Filesize
42KB

MD5
7b7ec509bb76d8aebc5122f935c2e219

SHA1
6e9bc488f9ded6d6e1a98304925eb3556a969a06

SHA256
de737f4127f063bafa7b7878d27079919a200b0974298ee59778659803a5144e

SHA512
9987fe9e46bf9879e2371689cd839f533acd85b3c405050234b3fe501bd005d1734ecb2aecb7c1576ed5c8f7cea7489da95582a13cb5c4161c6ab5cf9bc9470b

Download Submit
memory/524-68-0x0000000000000000-mapping.dmp

Download
memory/524-72-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/944-134-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/944-130-0x0000000000000000-mapping.dmp

Download
memory/1168-141-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1168-137-0x0000000000000000-mapping.dmp

Download
memory/1308-84-0x0000000000000000-mapping.dmp

Download
memory/1308-88-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1352-147-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1352-143-0x0000000000000000-mapping.dmp

Download
memory/1476-113-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1476-165-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1476-76-0x0000000000000000-mapping.dmp

Download
memory/1552-106-0x0000000000000000-mapping.dmp

Download
memory/1552-117-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1552-115-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1560-154-0x0000000070501000-0x0000000070503000-memory.dmp

Filesize
8KB

Download
memory/1560-156-0x00000000714ED000-0x00000000714F8000-memory.dmp

Filesize
44KB

Download
memory/1560-160-0x000000006BB01000-0x000000006BB03000-memory.dmp

Filesize
8KB

Download
memory/1560-161-0x00000000714ED000-0x00000000714F8000-memory.dmp

Filesize
44KB

Download
memory/1560-155-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1560-151-0x0000000000000000-mapping.dmp

Download
memory/1560-153-0x0000000072A81000-0x0000000072A84000-memory.dmp

Filesize
12KB

Download
memory/1560-158-0x000000006BC51000-0x000000006BC53000-memory.dmp

Filesize
8KB

Download
memory/1748-148-0x0000000002550000-0x000000000256A000-memory.dmp

Filesize
104KB

Download
memory/1748-166-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1748-98-0x0000000000000000-mapping.dmp

Download
memory/1748-114-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1748-149-0x0000000002550000-0x000000000256A000-memory.dmp

Filesize
104KB

Download
memory/1752-163-0x000007FEFBF91000-0x000007FEFBF93000-memory.dmp

Filesize
8KB

Download
memory/1752-162-0x0000000000000000-mapping.dmp

Download
memory/1776-110-0x0000000001C60000-0x0000000001C7A000-memory.dmp

Filesize
104KB

Download
memory/1776-111-0x0000000001C60000-0x0000000001C7A000-memory.dmp

Filesize
104KB

Download
memory/1776-152-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1776-57-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1776-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1776-150-0x0000000001C60000-0x0000000001C7A000-memory.dmp

Filesize
104KB

Download
memory/1824-94-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1824-90-0x0000000000000000-mapping.dmp

Download
memory/1828-124-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1828-119-0x0000000000000000-mapping.dmp

Download
memory/1892-123-0x0000000000000000-mapping.dmp

Download
memory/1892-128-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1920-112-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1920-60-0x0000000000000000-mapping.dmp

Download
memory/1920-164-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads