Analysis
-
max time kernel
176s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 08:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60a7e6244fa20ced7cd376ac1893ca9d.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
60a7e6244fa20ced7cd376ac1893ca9d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
60a7e6244fa20ced7cd376ac1893ca9d.exe
-
Size
45KB
-
MD5
60a7e6244fa20ced7cd376ac1893ca9d
-
SHA1
3e3e9758146ecccedfd698510b9ca3001d302249
-
SHA256
49bca1b2bff0e814b357e6e31573fa9cfe9de8054e1a73d5b691347f0799fe3b
-
SHA512
5e30fcf66d8893d47a30e4d6e28009625e09dfd20f049bfdf26261e10feabd2a3599f79bf232208ec09ce6de843631b402965bc53d8802f6f92d29a9988eca94
-
SSDEEP
768:E1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JXm:EOxyeFo6NPCAosxYyXdF5oy3VoKm
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 60a7e6244fa20ced7cd376ac1893ca9d.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 60a7e6244fa20ced7cd376ac1893ca9d.exe -
Executes dropped EXE 15 IoCs
pid Process 1280 SVCHOST.EXE 1860 SVCHOST.EXE 4476 SVCHOST.EXE 2212 SVCHOST.EXE 336 SVCHOST.EXE 3500 SPOOLSV.EXE 2696 SVCHOST.EXE 3416 SVCHOST.EXE 5104 SPOOLSV.EXE 452 SPOOLSV.EXE 1540 SVCHOST.EXE 3432 SPOOLSV.EXE 4120 SVCHOST.EXE 5040 SVCHOST.EXE 4052 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened for modification F:\Recycled\desktop.ini 60a7e6244fa20ced7cd376ac1893ca9d.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\M: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\S: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\U: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\N: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\Q: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\P: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\W: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\H: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\R: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\J: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\L: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\V: 60a7e6244fa20ced7cd376ac1893ca9d.exe File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 60a7e6244fa20ced7cd376ac1893ca9d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\TileInfo = "prop:Type;Size" 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 60a7e6244fa20ced7cd376ac1893ca9d.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\QuickTip = "prop:Type;Size" 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 60a7e6244fa20ced7cd376ac1893ca9d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings 60a7e6244fa20ced7cd376ac1893ca9d.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 988 WINWORD.EXE 988 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 3500 SPOOLSV.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 1280 SVCHOST.EXE 1280 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 1280 SVCHOST.EXE 1280 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 1280 SVCHOST.EXE 1280 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 1280 SVCHOST.EXE 1280 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 1280 SVCHOST.EXE 1280 SVCHOST.EXE 4476 SVCHOST.EXE 4476 SVCHOST.EXE 1280 SVCHOST.EXE 4476 SVCHOST.EXE 1280 SVCHOST.EXE 4476 SVCHOST.EXE 1280 SVCHOST.EXE 1280 SVCHOST.EXE 1280 SVCHOST.EXE 1280 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 1280 SVCHOST.EXE 1860 SVCHOST.EXE 4476 SVCHOST.EXE 2212 SVCHOST.EXE 336 SVCHOST.EXE 3500 SPOOLSV.EXE 2696 SVCHOST.EXE 3416 SVCHOST.EXE 5104 SPOOLSV.EXE 452 SPOOLSV.EXE 1540 SVCHOST.EXE 3432 SPOOLSV.EXE 4120 SVCHOST.EXE 5040 SVCHOST.EXE 4052 SPOOLSV.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE 988 WINWORD.EXE -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 5028 wrote to memory of 1280 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 92 PID 5028 wrote to memory of 1280 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 92 PID 5028 wrote to memory of 1280 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 92 PID 1280 wrote to memory of 1860 1280 SVCHOST.EXE 91 PID 1280 wrote to memory of 1860 1280 SVCHOST.EXE 91 PID 1280 wrote to memory of 1860 1280 SVCHOST.EXE 91 PID 1280 wrote to memory of 4476 1280 SVCHOST.EXE 113 PID 1280 wrote to memory of 4476 1280 SVCHOST.EXE 113 PID 1280 wrote to memory of 4476 1280 SVCHOST.EXE 113 PID 4476 wrote to memory of 2212 4476 SVCHOST.EXE 111 PID 4476 wrote to memory of 2212 4476 SVCHOST.EXE 111 PID 4476 wrote to memory of 2212 4476 SVCHOST.EXE 111 PID 4476 wrote to memory of 336 4476 SVCHOST.EXE 110 PID 4476 wrote to memory of 336 4476 SVCHOST.EXE 110 PID 4476 wrote to memory of 336 4476 SVCHOST.EXE 110 PID 4476 wrote to memory of 3500 4476 SVCHOST.EXE 109 PID 4476 wrote to memory of 3500 4476 SVCHOST.EXE 109 PID 4476 wrote to memory of 3500 4476 SVCHOST.EXE 109 PID 3500 wrote to memory of 2696 3500 SPOOLSV.EXE 108 PID 3500 wrote to memory of 2696 3500 SPOOLSV.EXE 108 PID 3500 wrote to memory of 2696 3500 SPOOLSV.EXE 108 PID 3500 wrote to memory of 3416 3500 SPOOLSV.EXE 107 PID 3500 wrote to memory of 3416 3500 SPOOLSV.EXE 107 PID 3500 wrote to memory of 3416 3500 SPOOLSV.EXE 107 PID 3500 wrote to memory of 5104 3500 SPOOLSV.EXE 105 PID 3500 wrote to memory of 5104 3500 SPOOLSV.EXE 105 PID 3500 wrote to memory of 5104 3500 SPOOLSV.EXE 105 PID 1280 wrote to memory of 452 1280 SVCHOST.EXE 104 PID 1280 wrote to memory of 452 1280 SVCHOST.EXE 104 PID 1280 wrote to memory of 452 1280 SVCHOST.EXE 104 PID 5028 wrote to memory of 1540 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 102 PID 5028 wrote to memory of 1540 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 102 PID 5028 wrote to memory of 1540 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 102 PID 5028 wrote to memory of 3432 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 101 PID 5028 wrote to memory of 3432 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 101 PID 5028 wrote to memory of 3432 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 101 PID 5028 wrote to memory of 4120 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 100 PID 5028 wrote to memory of 4120 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 100 PID 5028 wrote to memory of 4120 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 100 PID 1280 wrote to memory of 1440 1280 SVCHOST.EXE 98 PID 1280 wrote to memory of 1440 1280 SVCHOST.EXE 98 PID 1280 wrote to memory of 1440 1280 SVCHOST.EXE 98 PID 5028 wrote to memory of 5040 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 93 PID 5028 wrote to memory of 5040 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 93 PID 5028 wrote to memory of 5040 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 93 PID 5028 wrote to memory of 4052 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 97 PID 5028 wrote to memory of 4052 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 97 PID 5028 wrote to memory of 4052 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 97 PID 1440 wrote to memory of 1336 1440 userinit.exe 96 PID 1440 wrote to memory of 1336 1440 userinit.exe 96 PID 1440 wrote to memory of 1336 1440 userinit.exe 96 PID 5028 wrote to memory of 988 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 103 PID 5028 wrote to memory of 988 5028 60a7e6244fa20ced7cd376ac1893ca9d.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\60a7e6244fa20ced7cd376ac1893ca9d.exe"C:\Users\Admin\AppData\Local\Temp\60a7e6244fa20ced7cd376ac1893ca9d.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1440
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:452
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4476
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5040
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4052
-
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4120
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3432
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1540
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\60a7e6244fa20ced7cd376ac1893ca9d.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:988
-
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1860
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3012
-
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"1⤵PID:1336
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5104
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3416
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2696
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3500
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:336
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD54b21141a137bb5922c60744237c0cb3e
SHA10ec5a7b9dbe40af28d4cbb81d66ac92e47c98d60
SHA2565929f9dd887d2c71fccfa35e4223c737c2becb3d83509eda821636cdefead01d
SHA512c03a2f556c353a202882f824ce1e8866ee6c8cf5f1591b3078038e9c37348b911696161204f9a7857ef7bcae4671e5e296f236901d01ca0c7bb7e66e31336b71
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
45KB
MD57f8345904f3807eae2e120f9744f9a64
SHA18b5debbf48a92a032aeabb457ad253768d2e54f9
SHA2569a8ce9d78c7166fc4c65df7c8680956370d37765480070c1bc022935b321aa05
SHA5121e37d37b081605aa73c8d796955ad3c41b3feccdfb295373da043f002e3a7e1cd3b485c71204727b9b710b8e18a7507f387c7847d787452a6bfbf3bda1a6578b
-
Filesize
45KB
MD5e12562448ed78223b174df70213befe7
SHA11469596d4517f4789510ded8f2c2ef84b4976e2d
SHA2560588bf97aa128f601446b12996ef5009ca1b9a369d7d46561204a8d866c0b615
SHA51215379667a0e3f2f70d8fc2e328990c23d9bbf16ed7e15f35240cdde5e2490294726bbf85bf8513ba85eb508c8fb67f3f4c101f3338f0361c8a8dc76763c06a38