Analysis
- max time kernel
151s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
08/03/2024, 11:03
Behavioral task
behavioral1
Sample
bb1a8c7dcc5c2e73ab86dbd67b7de306.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
bb1a8c7dcc5c2e73ab86dbd67b7de306.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target bb1a8c7dcc5c2e73ab86dbd67b7de306.exe
- Size 42KB
- Sample240308-m5wg8ade24
- SHA256 15175f8ced26164e7417a710053114a467ffe4f8113e9b052d153d03d1fd123d
- MD5 bb1a8c7dcc5c2e73ab86dbd67b7de306
- SHA1 2504ac8848aafe2a185b66c9a4a455ffcdcc0db3
- SHA512 b6b58ef71072c99c27d0f389e65a303fac404c038ca1b74de3ff3b2773aaa66f71849614122029c5cb2bb42c5e067830a7b9d58ddd3640fdfe638cc323fa2e2a
- SSDEEP 768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888x:BzOCay4wV339rPjzbpLwRJ9pSdoIQ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" bb1a8c7dcc5c2e73ab86dbd67b7de306.exe - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (int) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (int) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE -
resource yara_rule behavioral2/files/0x000100000000002c-9.dat aspack_v212_v242 behavioral2/files/0x0007000000023219-17.dat aspack_v212_v242 behavioral2/files/0x000700000002321d-22.dat aspack_v212_v242 behavioral2/files/0x000700000002321d-36.dat aspack_v212_v242 behavioral2/files/0x000700000002321a-50.dat aspack_v212_v242 behavioral2/files/0x000700000002321d-55.dat aspack_v212_v242 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation bb1a8c7dcc5c2e73ab86dbd67b7de306.exe - Executes dropped EXE 12 IoCs
pid Process 64 SVCHOST.EXE 2596 SVCHOST.EXE 2960 SVCHOST.EXE 4672 SVCHOST.EXE 2288 SVCHOST.EXE 1944 SPOOLSV.EXE 3120 SVCHOST.EXE 3924 SVCHOST.EXE 116 SPOOLSV.EXE 3308 SPOOLSV.EXE 4644 SVCHOST.EXE 552 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened for modification F:\Recycled\desktop.ini bb1a8c7dcc5c2e73ab86dbd67b7de306.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\S: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\T: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\Y: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\O: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\L: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\E: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\V: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\M: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\N: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\H: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\W: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\J: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\K: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\G: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\P: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\Z: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\I: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\Q: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened (read-only) \??\X: bb1a8c7dcc5c2e73ab86dbd67b7de306.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe bb1a8c7dcc5c2e73ab86dbd67b7de306.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe bb1a8c7dcc5c2e73ab86dbd67b7de306.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE - Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\QuickTip = "prop:Type;Size" bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\InfoTip = "prop:Type;Write;Size" bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Key created \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\TileInfo = "prop:Type;Size" bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND bb1a8c7dcc5c2e73ab86dbd67b7de306.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND bb1a8c7dcc5c2e73ab86dbd67b7de306.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4956 WINWORD.EXE 4956 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1944 SPOOLSV.EXE 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 64 SVCHOST.EXE 64 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 64 SVCHOST.EXE 64 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 64 SVCHOST.EXE 2960 SVCHOST.EXE 64 SVCHOST.EXE 2960 SVCHOST.EXE 2960 SVCHOST.EXE 64 SVCHOST.EXE 2960 SVCHOST.EXE 64 SVCHOST.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4956 WINWORD.EXE 4956 WINWORD.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 64 SVCHOST.EXE 2596 SVCHOST.EXE 2960 SVCHOST.EXE 4672 SVCHOST.EXE 2288 SVCHOST.EXE 1944 SPOOLSV.EXE 3120 SVCHOST.EXE 3924 SVCHOST.EXE 116 SPOOLSV.EXE 3308 SPOOLSV.EXE 4644 SVCHOST.EXE 552 SPOOLSV.EXE 4956 WINWORD.EXE 4956 WINWORD.EXE 4956 WINWORD.EXE 4956 WINWORD.EXE 4956 WINWORD.EXE 4956 WINWORD.EXE 4956 WINWORD.EXE - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1976 wrote to memory of 64 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 89 PID 1976 wrote to memory of 64 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 89 PID 1976 wrote to memory of 64 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 89 PID 64 wrote to memory of 2596 64 SVCHOST.EXE 90 PID 64 wrote to memory of 2596 64 SVCHOST.EXE 90 PID 64 wrote to memory of 2596 64 SVCHOST.EXE 90 PID 64 wrote to memory of 2960 64 SVCHOST.EXE 92 PID 64 wrote to memory of 2960 64 SVCHOST.EXE 92 PID 64 wrote to memory of 2960 64 SVCHOST.EXE 92 PID 2960 wrote to memory of 4672 2960 SVCHOST.EXE 93 PID 2960 wrote to memory of 4672 2960 SVCHOST.EXE 93 PID 2960 wrote to memory of 4672 2960 SVCHOST.EXE 93 PID 2960 wrote to memory of 2288 2960 SVCHOST.EXE 94 PID 2960 wrote to memory of 2288 2960 SVCHOST.EXE 94 PID 2960 wrote to memory of 2288 2960 SVCHOST.EXE 94 PID 2960 wrote to memory of 1944 2960 SVCHOST.EXE 95 PID 2960 wrote to memory of 1944 2960 SVCHOST.EXE 95 PID 2960 wrote to memory of 1944 2960 SVCHOST.EXE 95 PID 1944 wrote to memory of 3120 1944 SPOOLSV.EXE 96 PID 1944 wrote to memory of 3120 1944 SPOOLSV.EXE 96 PID 1944 wrote to memory of 3120 1944 SPOOLSV.EXE 96 PID 1944 wrote to memory of 3924 1944 SPOOLSV.EXE 97 PID 1944 wrote to memory of 3924 1944 SPOOLSV.EXE 97 PID 1944 wrote to memory of 3924 1944 SPOOLSV.EXE 97 PID 1944 wrote to memory of 116 1944 SPOOLSV.EXE 98 PID 1944 wrote to memory of 116 1944 SPOOLSV.EXE 98 PID 1944 wrote to memory of 116 1944 SPOOLSV.EXE 98 PID 64 wrote to memory of 3308 64 SVCHOST.EXE 99 PID 64 wrote to memory of 3308 64 SVCHOST.EXE 99 PID 64 wrote to memory of 3308 64 SVCHOST.EXE 99 PID 1976 wrote to memory of 4644 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 100 PID 1976 wrote to memory of 4644 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 100 PID 1976 wrote to memory of 4644 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 100 PID 1976 wrote to memory of 552 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 101 PID 1976 wrote to memory of 552 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 101 PID 1976 wrote to memory of 552 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 101 PID 1976 wrote to memory of 4956 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 102 PID 1976 wrote to memory of 4956 1976 bb1a8c7dcc5c2e73ab86dbd67b7de306.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb1a8c7dcc5c2e73ab86dbd67b7de306.exe"C:\Users\Admin\AppData\Local\Temp\bb1a8c7dcc5c2e73ab86dbd67b7de306.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:64 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2596
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4672
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2288
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3120
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3924
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:116
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3308
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4644
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:552
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bb1a8c7dcc5c2e73ab86dbd67b7de306.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SPOOLSV.EXE
- Size 42KB
- SHA256 e19eb6593f07d7f184352cadd531ae90ae08613ae2ca50b14b265eb0be02c9fd
- MD5 0e5c0fe4a4fea54603ffa0e38e1736e9
- SHA1 b988333bce173a619f1e33ff03ba67dc1cf3d233
- SHA512 4142739a1e889cfe6bb2630a40708cc12d020ed6b17b1a4f6e646d787a0dc586b5eae725b8f3a9e14f4dcfcfcc9999c1c5a813c39f007f1a55e2f05cfb95adf7
- SSDEEP 768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D88888888883:BzOCay4wV339rPjzbpLwRJ9pSdoIi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Recycled\SVCHOST.EXE
- Size 42KB
- SHA256 6976346932adc87eea73c3ad7e8fe3e6cd2019ca49a4ab2a985f08941998ddc5
- MD5 a49119401e5303d3d5ed7279bc8c6a87
- SHA1 e56376b51f38ad9e44756dee2720801abe2685ca
- SHA512 225e58d265b038dfade3376ae6fc481eec5eacc23de6ba32114a274be7108418b276f52828d1378553810d19674549d14592f3a1fa6f76ff3476964ef5e12c82
- SSDEEP 768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888O:BzOCay4wV339rPjzbpLwRJ9pSdoIj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 2KB
- SHA256 2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
- MD5 1a1dce35d60d2c70ca8894954fd5d384
- SHA1 58547dd65d506c892290755010d0232da34ee000
- SHA512 4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\ Explorer.exe
- Size 42KB
- SHA256 b8e19abed999d3ee4daa86852aff5f3905126cbec3704e67685c9fc69f4ebb77
- MD5 6d41b19180cab664ebfe51237b56b70c
- SHA1 164d2da65f3a616b1d5e455755eaeae0cff5b402
- SHA512 ac72639c737d460addbbd8f487f273a568bb47d1201921a33a410bb369d948b15d9c8f08c9e43f8c3cb10d55e42089f0e79294d32976405390beff7a388315bf
- SSDEEP 768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888+:BzOCay4wV339rPjzbpLwRJ9pSdoI/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 42KB
- SHA256 b504efb2adcc387d41291c4e13a7200fa3a428570ce0c0da6112fa6cadb0953d
- MD5 ffd018c2f008d143e6adeadff12887b2
- SHA1 10fc159bf7293ef1d73cd9c44cf4edc951636965
- SHA512 d0736225f7a326871ccfc23d23dfffd98260a8b58349d4ae8e4107a9bfc11234baabf3d78c887a815652fa73bfe1a0041dad4e58da6b6980388ff1336c017b76
- SSDEEP 768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888N:BzOCay4wV339rPjzbpLwRJ9pSdoIE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 42KB
- SHA256 ef707c74b569c93869895ac39a9c9156c9f5001c48423ae83562681780cde136
- MD5 c40811c967be19e44064969cf5608656
- SHA1 9196c09b6efcf20336bbb9bc90ff2081cddc4100
- SHA512 45b8c5da8fdf89bb60b2dc96cd05445916ae1f4d713a5536034b9514ce939231ba8cb3cefabeeaf67489719a67b6f88521df1b9c364db33b890bdc7916ee88bd
- SSDEEP 768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888a:BzOCay4wV339rPjzbpLwRJ9pSdoIv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path F:\Recycled\SVCHOST.EXE
- Size 42KB
- SHA256 6e2dca237ea4754fb752b31e59b2fbcec08e37284429b159eebc0da2d37b5be2
- MD5 e49771ae989a391ddec50dacc151883d
- SHA1 0b0b12b0b0ec41319daa5545adefadc7cb14921d
- SHA512 2c8a28591cfa91e07a899a3f1def42e412fb542fab8579cc176a154cc5aff1496b8288b78c74f6219137873a7be375ba57fc182fe04f2e117cd5b8432edc5b74
- SSDEEP 768:gSz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D88888888882:BzOCay4wV339rPjzbpLwRJ9pSdoIL
- MD5 SHA1 SHA512 SSDEEP