c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463

Processes:

SPOOLSV.EXESVCHOST.EXEc577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exeCTFMON.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	CTFMON.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

Processes:

CTFMON.EXESPOOLSV.EXESVCHOST.EXEc577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

Modify Registry

Processes:

CTFMON.EXESPOOLSV.EXESVCHOST.EXEc577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

ASPack v2.12-2.42 21 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Recycled\SVCHOST.EXE	aspack_v212_v242
C:\recycled\SVCHOST.EXE	aspack_v212_v242
C:\Windows\Fonts\ Explorer.exe	aspack_v212_v242
C:\Recycled\SVCHOST.EXE	aspack_v212_v242
C:\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Windows\Fonts\ Explorer.exe	aspack_v212_v242
C:\Recycled\SVCHOST.EXE	aspack_v212_v242
C:\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Recycled\CTFMON.EXE	aspack_v212_v242
C:\recycled\CTFMON.EXE	aspack_v212_v242
C:\Windows\Fonts\ Explorer.exe	aspack_v212_v242
C:\Recycled\SVCHOST.EXE	aspack_v212_v242
C:\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Recycled\CTFMON.EXE	aspack_v212_v242
C:\Recycled\CTFMON.EXE	aspack_v212_v242
C:\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Recycled\CTFMON.EXE	aspack_v212_v242
C:\Recycled\SVCHOST.EXE	aspack_v212_v242
C:\Recycled\SPOOLSV.EXE	aspack_v212_v242
C:\Recycled\CTFMON.EXE	aspack_v212_v242

Executes dropped EXE 15 IoCs

Processes:

SVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXE

pid	process
4304	SVCHOST.EXE
1836	SVCHOST.EXE
4476	SPOOLSV.EXE
4272	SVCHOST.EXE
3208	SPOOLSV.EXE
4868	CTFMON.EXE
4276	SVCHOST.EXE
4512	SPOOLSV.EXE
4376	CTFMON.EXE
3828	CTFMON.EXE
1928	SPOOLSV.EXE
3916	CTFMON.EXE
1052	SVCHOST.EXE
3264	SPOOLSV.EXE
212	CTFMON.EXE

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

description ioc process

File opened for modification C:\Recycled\desktop.ini c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

description	ioc	process
File opened for modification	C:\Recycled\desktop.ini	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

CTFMON.EXEc577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exeSPOOLSV.EXESVCHOST.EXE

description	ioc	process
File opened (read-only)	\??\G:	CTFMON.EXE
File opened (read-only)	\??\I:	CTFMON.EXE
File opened (read-only)	\??\M:	CTFMON.EXE
File opened (read-only)	\??\P:	CTFMON.EXE
File opened (read-only)	\??\R:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\H:	SPOOLSV.EXE
File opened (read-only)	\??\F:	CTFMON.EXE
File opened (read-only)	\??\Y:	SVCHOST.EXE
File opened (read-only)	\??\E:	SPOOLSV.EXE
File opened (read-only)	\??\O:	SPOOLSV.EXE
File opened (read-only)	\??\Q:	CTFMON.EXE
File opened (read-only)	\??\R:	CTFMON.EXE
File opened (read-only)	\??\N:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\Q:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\Z:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\W:	CTFMON.EXE
File opened (read-only)	\??\N:	SVCHOST.EXE
File opened (read-only)	\??\L:	SPOOLSV.EXE
File opened (read-only)	\??\L:	CTFMON.EXE
File opened (read-only)	\??\X:	CTFMON.EXE
File opened (read-only)	\??\P:	SVCHOST.EXE
File opened (read-only)	\??\X:	SVCHOST.EXE
File opened (read-only)	\??\T:	CTFMON.EXE
File opened (read-only)	\??\J:	SPOOLSV.EXE
File opened (read-only)	\??\H:	CTFMON.EXE
File opened (read-only)	\??\M:	SPOOLSV.EXE
File opened (read-only)	\??\P:	SPOOLSV.EXE
File opened (read-only)	\??\R:	SPOOLSV.EXE
File opened (read-only)	\??\U:	SPOOLSV.EXE
File opened (read-only)	\??\V:	SPOOLSV.EXE
File opened (read-only)	\??\G:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\U:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\X:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\S:	CTFMON.EXE
File opened (read-only)	\??\Y:	CTFMON.EXE
File opened (read-only)	\??\Z:	CTFMON.EXE
File opened (read-only)	\??\X:	SPOOLSV.EXE
File opened (read-only)	\??\M:	SVCHOST.EXE
File opened (read-only)	\??\V:	SVCHOST.EXE
File opened (read-only)	\??\W:	SPOOLSV.EXE
File opened (read-only)	\??\S:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\I:	SPOOLSV.EXE
File opened (read-only)	\??\E:	CTFMON.EXE
File opened (read-only)	\??\I:	SVCHOST.EXE
File opened (read-only)	\??\O:	SVCHOST.EXE
File opened (read-only)	\??\N:	SPOOLSV.EXE
File opened (read-only)	\??\Y:	SPOOLSV.EXE
File opened (read-only)	\??\H:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\I:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\G:	SVCHOST.EXE
File opened (read-only)	\??\Q:	SVCHOST.EXE
File opened (read-only)	\??\F:	SPOOLSV.EXE
File opened (read-only)	\??\F:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\O:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\K:	SVCHOST.EXE
File opened (read-only)	\??\P:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\H:	SVCHOST.EXE
File opened (read-only)	\??\U:	SVCHOST.EXE
File opened (read-only)	\??\S:	SPOOLSV.EXE
File opened (read-only)	\??\V:	CTFMON.EXE
File opened (read-only)	\??\J:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\K:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\M:	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened (read-only)	\??\U:	CTFMON.EXE

Drops file in Program Files directory 1 IoCs

Processes:

c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe

Drops file in Windows directory 4 IoCs

Processes:

c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exeSVCHOST.EXESPOOLSV.EXECTFMON.EXE

description	ioc	process
File opened for modification	C:\Windows\Fonts\ Explorer.exe	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
File opened for modification	C:\Windows\Fonts\ Explorer.exe	SVCHOST.EXE
File opened for modification	C:\Windows\Fonts\ Explorer.exe	SPOOLSV.EXE
File opened for modification	C:\Windows\Fonts\ Explorer.exe	CTFMON.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 29 IoCs

Processes:

c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exeSVCHOST.EXECTFMON.EXESPOOLSV.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\TileInfo = "prop:Type;Size"	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\TileInfo = "prop:Type;Size"	CTFMON.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\QuickTip = "prop:Type;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	CTFMON.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\InfoTip = "prop:Type;Write;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\QuickTip = "prop:Type;Size"	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\TileInfo = "prop:Type;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	CTFMON.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\QuickTip = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\TileInfo = "prop:Type;Size"	SVCHOST.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\*\QuickTip = "prop:Type;Size"	CTFMON.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4196 WINWORD.EXE
4196 WINWORD.EXE

pid	process
4196	WINWORD.EXE
4196	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exeSPOOLSV.EXESVCHOST.EXECTFMON.EXE

pid	process
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4868	CTFMON.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4476	SPOOLSV.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE
4304	SVCHOST.EXE

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exeSVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXEWINWORD.EXE

pid	process
1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
4304	SVCHOST.EXE
1836	SVCHOST.EXE
4476	SPOOLSV.EXE
4272	SVCHOST.EXE
3208	SPOOLSV.EXE
4868	CTFMON.EXE
4276	SVCHOST.EXE
4512	SPOOLSV.EXE
4376	CTFMON.EXE
3828	CTFMON.EXE
1928	SPOOLSV.EXE
3916	CTFMON.EXE
1052	SVCHOST.EXE
3264	SPOOLSV.EXE
212	CTFMON.EXE
4196	WINWORD.EXE
4196	WINWORD.EXE
4196	WINWORD.EXE
4196	WINWORD.EXE
4196	WINWORD.EXE
4196	WINWORD.EXE
4196	WINWORD.EXE
4196	WINWORD.EXE

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exeSVCHOST.EXESPOOLSV.EXECTFMON.EXE

description	pid	process	target process
PID 1828 wrote to memory of 4304	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SVCHOST.EXE
PID 1828 wrote to memory of 4304	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SVCHOST.EXE
PID 1828 wrote to memory of 4304	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SVCHOST.EXE
PID 4304 wrote to memory of 1836	4304	SVCHOST.EXE	SVCHOST.EXE
PID 4304 wrote to memory of 1836	4304	SVCHOST.EXE	SVCHOST.EXE
PID 4304 wrote to memory of 1836	4304	SVCHOST.EXE	SVCHOST.EXE
PID 4304 wrote to memory of 4476	4304	SVCHOST.EXE	SPOOLSV.EXE
PID 4304 wrote to memory of 4476	4304	SVCHOST.EXE	SPOOLSV.EXE
PID 4304 wrote to memory of 4476	4304	SVCHOST.EXE	SPOOLSV.EXE
PID 4476 wrote to memory of 4272	4476	SPOOLSV.EXE	SVCHOST.EXE
PID 4476 wrote to memory of 4272	4476	SPOOLSV.EXE	SVCHOST.EXE
PID 4476 wrote to memory of 4272	4476	SPOOLSV.EXE	SVCHOST.EXE
PID 4476 wrote to memory of 3208	4476	SPOOLSV.EXE	SPOOLSV.EXE
PID 4476 wrote to memory of 3208	4476	SPOOLSV.EXE	SPOOLSV.EXE
PID 4476 wrote to memory of 3208	4476	SPOOLSV.EXE	SPOOLSV.EXE
PID 4476 wrote to memory of 4868	4476	SPOOLSV.EXE	CTFMON.EXE
PID 4476 wrote to memory of 4868	4476	SPOOLSV.EXE	CTFMON.EXE
PID 4476 wrote to memory of 4868	4476	SPOOLSV.EXE	CTFMON.EXE
PID 4868 wrote to memory of 4276	4868	CTFMON.EXE	SVCHOST.EXE
PID 4868 wrote to memory of 4276	4868	CTFMON.EXE	SVCHOST.EXE
PID 4868 wrote to memory of 4276	4868	CTFMON.EXE	SVCHOST.EXE
PID 4868 wrote to memory of 4512	4868	CTFMON.EXE	SPOOLSV.EXE
PID 4868 wrote to memory of 4512	4868	CTFMON.EXE	SPOOLSV.EXE
PID 4868 wrote to memory of 4512	4868	CTFMON.EXE	SPOOLSV.EXE
PID 4868 wrote to memory of 4376	4868	CTFMON.EXE	CTFMON.EXE
PID 4868 wrote to memory of 4376	4868	CTFMON.EXE	CTFMON.EXE
PID 4868 wrote to memory of 4376	4868	CTFMON.EXE	CTFMON.EXE
PID 4304 wrote to memory of 3828	4304	SVCHOST.EXE	CTFMON.EXE
PID 4304 wrote to memory of 3828	4304	SVCHOST.EXE	CTFMON.EXE
PID 4304 wrote to memory of 3828	4304	SVCHOST.EXE	CTFMON.EXE
PID 1828 wrote to memory of 1928	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SPOOLSV.EXE
PID 1828 wrote to memory of 1928	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SPOOLSV.EXE
PID 1828 wrote to memory of 1928	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SPOOLSV.EXE
PID 1828 wrote to memory of 3916	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	CTFMON.EXE
PID 1828 wrote to memory of 3916	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	CTFMON.EXE
PID 1828 wrote to memory of 3916	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	CTFMON.EXE
PID 1828 wrote to memory of 1052	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SVCHOST.EXE
PID 1828 wrote to memory of 1052	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SVCHOST.EXE
PID 1828 wrote to memory of 1052	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SVCHOST.EXE
PID 1828 wrote to memory of 3264	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SPOOLSV.EXE
PID 1828 wrote to memory of 3264	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SPOOLSV.EXE
PID 1828 wrote to memory of 3264	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	SPOOLSV.EXE
PID 1828 wrote to memory of 212	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	CTFMON.EXE
PID 1828 wrote to memory of 212	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	CTFMON.EXE
PID 1828 wrote to memory of 212	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	CTFMON.EXE
PID 1828 wrote to memory of 4196	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	WINWORD.EXE
PID 1828 wrote to memory of 4196	1828	c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe
"C:\Users\Admin\AppData\Local\Temp\c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1836

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4272

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3208

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4276

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4512

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4376

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3828

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1928

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3916

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1052

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3264

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:212

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c577649923bdabe3666fef4cc7c091da0ab618723d1a842f943195c60a603463.doc" /o ""
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

Credential Access

Discovery

Query Registry

System Information Discovery