0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab

General

Target

0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
Size

97KB
MD5

26f62a6cc9fcd51786bb9f650254e8f0
SHA1

4e1c14b29498ff62563b3c646d6dc55d5662491c
SHA256

0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab
SHA512

2059661ebe77af71bfec0994b283c6f4a42e6f375a9f74d90242edd025ef44413b89e397b47a707134123fecbf59328446f23738c84a7a1a87134acfb8bfbdd7
SSDEEP

1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI8:J8dfX7y9DZ+N7eB+tI8

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

SVCHOST.EXESVCHOST.EXE0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exeSPOOLSV.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\""	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SPOOLSV.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

SPOOLSV.EXESVCHOST.EXESVCHOST.EXE0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

SVCHOST.EXE0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exeSPOOLSV.EXESVCHOST.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SVCHOST.EXE

Executes dropped EXE 12 IoCs

Processes:

SVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESVCHOST.EXESPOOLSV.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXE

pid	process
3028	SVCHOST.EXE
2812	SVCHOST.EXE
2960	SVCHOST.EXE
2628	SVCHOST.EXE
2424	SVCHOST.EXE
2480	SPOOLSV.EXE
2168	SVCHOST.EXE
1484	SVCHOST.EXE
1548	SPOOLSV.EXE
2416	SPOOLSV.EXE
1884	SVCHOST.EXE
1864	SPOOLSV.EXE

Loads dropped DLL 21 IoCs

Processes:

0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exeSVCHOST.EXESVCHOST.EXESPOOLSV.EXE

pid	process
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe

description	ioc	process
File opened for modification	C:\Recycled\desktop.ini	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened for modification	F:\Recycled\desktop.ini	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SVCHOST.EXESPOOLSV.EXE0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exeSVCHOST.EXE

description	ioc	process
File opened (read-only)	\??\P:	SVCHOST.EXE
File opened (read-only)	\??\V:	SVCHOST.EXE
File opened (read-only)	\??\K:	SPOOLSV.EXE
File opened (read-only)	\??\V:	SPOOLSV.EXE
File opened (read-only)	\??\U:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\X:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\V:	SVCHOST.EXE
File opened (read-only)	\??\H:	SPOOLSV.EXE
File opened (read-only)	\??\M:	SPOOLSV.EXE
File opened (read-only)	\??\S:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\R:	SVCHOST.EXE
File opened (read-only)	\??\L:	SVCHOST.EXE
File opened (read-only)	\??\I:	SVCHOST.EXE
File opened (read-only)	\??\Y:	SVCHOST.EXE
File opened (read-only)	\??\P:	SPOOLSV.EXE
File opened (read-only)	\??\R:	SPOOLSV.EXE
File opened (read-only)	\??\H:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\Y:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\E:	SVCHOST.EXE
File opened (read-only)	\??\Z:	SVCHOST.EXE
File opened (read-only)	\??\Y:	SPOOLSV.EXE
File opened (read-only)	\??\E:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\W:	SVCHOST.EXE
File opened (read-only)	\??\Q:	SVCHOST.EXE
File opened (read-only)	\??\R:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\P:	SVCHOST.EXE
File opened (read-only)	\??\U:	SVCHOST.EXE
File opened (read-only)	\??\E:	SPOOLSV.EXE
File opened (read-only)	\??\N:	SPOOLSV.EXE
File opened (read-only)	\??\T:	SPOOLSV.EXE
File opened (read-only)	\??\U:	SPOOLSV.EXE
File opened (read-only)	\??\Z:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\K:	SVCHOST.EXE
File opened (read-only)	\??\I:	SVCHOST.EXE
File opened (read-only)	\??\P:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\X:	SVCHOST.EXE
File opened (read-only)	\??\N:	SVCHOST.EXE
File opened (read-only)	\??\G:	SVCHOST.EXE
File opened (read-only)	\??\Q:	SVCHOST.EXE
File opened (read-only)	\??\Z:	SVCHOST.EXE
File opened (read-only)	\??\H:	SVCHOST.EXE
File opened (read-only)	\??\Y:	SVCHOST.EXE
File opened (read-only)	\??\L:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\V:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\W:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\O:	SVCHOST.EXE
File opened (read-only)	\??\T:	SVCHOST.EXE
File opened (read-only)	\??\S:	SPOOLSV.EXE
File opened (read-only)	\??\Z:	SPOOLSV.EXE
File opened (read-only)	\??\G:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\I:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\H:	SVCHOST.EXE
File opened (read-only)	\??\M:	SVCHOST.EXE
File opened (read-only)	\??\O:	SVCHOST.EXE
File opened (read-only)	\??\R:	SVCHOST.EXE
File opened (read-only)	\??\Q:	SPOOLSV.EXE
File opened (read-only)	\??\X:	SPOOLSV.EXE
File opened (read-only)	\??\L:	SVCHOST.EXE
File opened (read-only)	\??\N:	SVCHOST.EXE
File opened (read-only)	\??\E:	SVCHOST.EXE
File opened (read-only)	\??\M:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened (read-only)	\??\M:	SVCHOST.EXE
File opened (read-only)	\??\X:	SVCHOST.EXE
File opened (read-only)	\??\O:	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe

Drops file in Windows directory 6 IoCs

Processes:

SVCHOST.EXESPOOLSV.EXEWINWORD.EXE0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exeSVCHOST.EXE

description	ioc	process
File opened for modification	C:\Windows\Fonts\ Explorer.exe	SVCHOST.EXE
File opened for modification	C:\Windows\Fonts\ Explorer.exe	SPOOLSV.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\Fonts\ Explorer.exe	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
File opened for modification	C:\Windows\Fonts\ Explorer.exe	SVCHOST.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exeSPOOLSV.EXEWINWORD.EXESVCHOST.EXESVCHOST.EXE

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG\COMMAND	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size"	SPOOLSV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size"	SPOOLSV.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size"	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size"	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size"	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

372 WINWORD.EXE

pid	process
372	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

SVCHOST.EXE0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exeSVCHOST.EXESPOOLSV.EXE

pid	process
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2960	SVCHOST.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
2480	SPOOLSV.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE
3028	SVCHOST.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exeSVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESVCHOST.EXESPOOLSV.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXEWINWORD.EXE

pid	process
2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
3028	SVCHOST.EXE
2812	SVCHOST.EXE
2960	SVCHOST.EXE
2628	SVCHOST.EXE
2424	SVCHOST.EXE
2480	SPOOLSV.EXE
2168	SVCHOST.EXE
1484	SVCHOST.EXE
1548	SPOOLSV.EXE
2416	SPOOLSV.EXE
1884	SVCHOST.EXE
1864	SPOOLSV.EXE
372	WINWORD.EXE
372	WINWORD.EXE

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exeSVCHOST.EXESVCHOST.EXESPOOLSV.EXEWINWORD.EXE

description	pid	process	target process
PID 2400 wrote to memory of 3028	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SVCHOST.EXE
PID 2400 wrote to memory of 3028	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SVCHOST.EXE
PID 2400 wrote to memory of 3028	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SVCHOST.EXE
PID 2400 wrote to memory of 3028	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SVCHOST.EXE
PID 3028 wrote to memory of 2812	3028	SVCHOST.EXE	SVCHOST.EXE
PID 3028 wrote to memory of 2812	3028	SVCHOST.EXE	SVCHOST.EXE
PID 3028 wrote to memory of 2812	3028	SVCHOST.EXE	SVCHOST.EXE
PID 3028 wrote to memory of 2812	3028	SVCHOST.EXE	SVCHOST.EXE
PID 3028 wrote to memory of 2960	3028	SVCHOST.EXE	SVCHOST.EXE
PID 3028 wrote to memory of 2960	3028	SVCHOST.EXE	SVCHOST.EXE
PID 3028 wrote to memory of 2960	3028	SVCHOST.EXE	SVCHOST.EXE
PID 3028 wrote to memory of 2960	3028	SVCHOST.EXE	SVCHOST.EXE
PID 2960 wrote to memory of 2628	2960	SVCHOST.EXE	SVCHOST.EXE
PID 2960 wrote to memory of 2628	2960	SVCHOST.EXE	SVCHOST.EXE
PID 2960 wrote to memory of 2628	2960	SVCHOST.EXE	SVCHOST.EXE
PID 2960 wrote to memory of 2628	2960	SVCHOST.EXE	SVCHOST.EXE
PID 2960 wrote to memory of 2424	2960	SVCHOST.EXE	SVCHOST.EXE
PID 2960 wrote to memory of 2424	2960	SVCHOST.EXE	SVCHOST.EXE
PID 2960 wrote to memory of 2424	2960	SVCHOST.EXE	SVCHOST.EXE
PID 2960 wrote to memory of 2424	2960	SVCHOST.EXE	SVCHOST.EXE
PID 2960 wrote to memory of 2480	2960	SVCHOST.EXE	SPOOLSV.EXE
PID 2960 wrote to memory of 2480	2960	SVCHOST.EXE	SPOOLSV.EXE
PID 2960 wrote to memory of 2480	2960	SVCHOST.EXE	SPOOLSV.EXE
PID 2960 wrote to memory of 2480	2960	SVCHOST.EXE	SPOOLSV.EXE
PID 2480 wrote to memory of 2168	2480	SPOOLSV.EXE	SVCHOST.EXE
PID 2480 wrote to memory of 2168	2480	SPOOLSV.EXE	SVCHOST.EXE
PID 2480 wrote to memory of 2168	2480	SPOOLSV.EXE	SVCHOST.EXE
PID 2480 wrote to memory of 2168	2480	SPOOLSV.EXE	SVCHOST.EXE
PID 2480 wrote to memory of 1484	2480	SPOOLSV.EXE	SVCHOST.EXE
PID 2480 wrote to memory of 1484	2480	SPOOLSV.EXE	SVCHOST.EXE
PID 2480 wrote to memory of 1484	2480	SPOOLSV.EXE	SVCHOST.EXE
PID 2480 wrote to memory of 1484	2480	SPOOLSV.EXE	SVCHOST.EXE
PID 2480 wrote to memory of 1548	2480	SPOOLSV.EXE	SPOOLSV.EXE
PID 2480 wrote to memory of 1548	2480	SPOOLSV.EXE	SPOOLSV.EXE
PID 2480 wrote to memory of 1548	2480	SPOOLSV.EXE	SPOOLSV.EXE
PID 2480 wrote to memory of 1548	2480	SPOOLSV.EXE	SPOOLSV.EXE
PID 3028 wrote to memory of 2416	3028	SVCHOST.EXE	SPOOLSV.EXE
PID 3028 wrote to memory of 2416	3028	SVCHOST.EXE	SPOOLSV.EXE
PID 3028 wrote to memory of 2416	3028	SVCHOST.EXE	SPOOLSV.EXE
PID 3028 wrote to memory of 2416	3028	SVCHOST.EXE	SPOOLSV.EXE
PID 2400 wrote to memory of 1884	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SVCHOST.EXE
PID 2400 wrote to memory of 1884	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SVCHOST.EXE
PID 2400 wrote to memory of 1884	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SVCHOST.EXE
PID 2400 wrote to memory of 1884	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SVCHOST.EXE
PID 2400 wrote to memory of 1864	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SPOOLSV.EXE
PID 2400 wrote to memory of 1864	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SPOOLSV.EXE
PID 2400 wrote to memory of 1864	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SPOOLSV.EXE
PID 2400 wrote to memory of 1864	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	SPOOLSV.EXE
PID 2400 wrote to memory of 372	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	WINWORD.EXE
PID 2400 wrote to memory of 372	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	WINWORD.EXE
PID 2400 wrote to memory of 372	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	WINWORD.EXE
PID 2400 wrote to memory of 372	2400	0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe	WINWORD.EXE
PID 372 wrote to memory of 2528	372	WINWORD.EXE	splwow64.exe
PID 372 wrote to memory of 2528	372	WINWORD.EXE	splwow64.exe
PID 372 wrote to memory of 2528	372	WINWORD.EXE	splwow64.exe
PID 372 wrote to memory of 2528	372	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe
"C:\Users\Admin\AppData\Local\Temp\0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2812

F:\recycled\SVCHOST.EXE
F:\recycled\SVCHOST.EXE :agent
3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2628

F:\recycled\SVCHOST.EXE
F:\recycled\SVCHOST.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2424

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2168

F:\recycled\SVCHOST.EXE
F:\recycled\SVCHOST.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1548

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2416

F:\recycled\SVCHOST.EXE
F:\recycled\SVCHOST.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1884

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1864

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0720771916f404e2cd628efabb7e3de832e62a56deec70b3df3a8a2ba71aa6ab.doc"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:2528

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recycled\SVCHOST.EXE
Filesize
97KB

MD5
a6cc653d1faf9587afe92ff0ea111e59

SHA1
a46673cfd77c9a98780e131e5cde4571410d6a4f

SHA256
5e6acc28d085a27b8e426a735e2ed4f5b3512a9fccc8fe2b43afbe619750a803

SHA512
aabdec2ae9d86673df428a512a3a870d8c4e3a12a6d12457940526fe99e76b28fbe1c8c2e11ccaee325c09b8e9562681531e7d7e0bca678e4b6aaa1a9a18c9da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
Filesize
2KB

MD5
1a1dce35d60d2c70ca8894954fd5d384

SHA1
58547dd65d506c892290755010d0232da34ee000

SHA256
2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c

SHA512
4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e

Download Submit
C:\Windows\Fonts\ Explorer.exe
Filesize
97KB

MD5
6b0fd7f6ec50d254e61a629b8e094304

SHA1
1f1c6892e69ef356f096a5b0304cf1f5de7fa3bf

SHA256
3b4a88ef627e7223bb0068703615e9d8081e2cf57cbf32adcc49d1a9d7c8cb84

SHA512
70eff76f13ac1ec61966729dfd71a39691ad10eaec97764e09d200653e0f708db72c382768ef3c0c6356402f996ac3289a8e7731d2c708723d0d6205ca7a831f

Download Submit
C:\Windows\Fonts\ Explorer.exe
Filesize
97KB

MD5
aa603e945a3f786b470c05882dd3ffb8

SHA1
da803c4ba4a7d109141065fca3ac20aa957c97b9

SHA256
4bc5afd3020ebefa89b48c50deae385bb59331b258c3aedc644e0bfa40355b83

SHA512
f0c0a65c9196e10b222b7b59329dd22ed7962a4261ad3901feac32e2860c416e9f734570d6722d755864f0732b5b9fdf39aa9edaf822150d0a597e5aba87dbd3

Download Submit
C:\Windows\Fonts\ Explorer.exe
Filesize
97KB

MD5
88c927c46752e3b0c366581c6302f8e2

SHA1
ab3801ae3bbd321e17518f6e752828b860f91000

SHA256
ab0536abe46cb556a958a1fa490c7dd67df759056db2f5865435a4696efc85e0

SHA512
1b37d8ceaf66d59d26a955fe795fcbd7d1837c4405cc708c219d3c4d84dbbd97fce034808196e8c98a06f176d854d58160dbea0b734df10af2dd445c800a29d0

Download Submit
C:\begolu.txt
Filesize
2B

MD5
2b9d4fa85c8e82132bde46b143040142

SHA1
a02431cf7c501a5b368c91e41283419d8fa9fb03

SHA256
4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142

SHA512
c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be

Download Submit
C:\recycled\SPOOLSV.EXE
Filesize
97KB

MD5
6e55226d0cd571adbca736586de65eec

SHA1
02f8b2f8ce1b83d697c0cdaa96f9a6b682dcc3f6

SHA256
0323429874445f5f07e53402b0855dbba895085061aba516fc7c63b275a7db8e

SHA512
e33e419a6050a40726daedb041e85e7e7e5e0c387dfea7245d50fa8c3c4eaff61dd19af2f23ebd2209b242299256e19b49c633836f31df7ca395430485ce4e74

Download Submit
F:\Recycled\SVCHOST.EXE
Filesize
97KB

MD5
d065d16146eb65074bf6ca02ca64dd10

SHA1
e9455b18b3e16c3a0b470fcc07eddd5ffb84ec2d

SHA256
99a0d9a9d84575794e3f79e5d5583c99d453a6604dcfc3a7342b13cf9ee03c1d

SHA512
82ff426885c1c28ca96c5e3e288e0fb43f3fddc452b2a523ba853ca4296cc21fb28198d990b77dfcd7b6b122f17964c0dbea1b77303155dd2d896c1f0547ebba

Download Submit
memory/372-120-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1484-89-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1548-94-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1864-112-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1864-116-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1884-105-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1884-110-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2168-82-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2400-23-0x0000000000820000-0x0000000000841000-memory.dmp

Filesize
132KB

Download
memory/2400-22-0x0000000000820000-0x0000000000841000-memory.dmp

Filesize
132KB

Download
memory/2400-113-0x0000000000820000-0x0000000000841000-memory.dmp

Filesize
132KB

Download
memory/2400-119-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2400-117-0x0000000004730000-0x0000000004740000-memory.dmp

Filesize
64KB

Download
memory/2400-104-0x0000000000820000-0x0000000000841000-memory.dmp

Filesize
132KB

Download
memory/2400-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2416-100-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2424-66-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2480-91-0x0000000002FF0000-0x0000000003011000-memory.dmp

Filesize
132KB

Download
memory/2480-74-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2628-59-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2812-38-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2812-37-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-45-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2960-56-0x00000000024A0000-0x00000000024C1000-memory.dmp

Filesize
132KB

Download
memory/2960-67-0x00000000024A0000-0x00000000024C1000-memory.dmp

Filesize
132KB

Download
memory/2960-55-0x00000000024A0000-0x00000000024C1000-memory.dmp

Filesize
132KB

Download
memory/3028-41-0x0000000001D90000-0x0000000001DB1000-memory.dmp

Filesize
132KB

Download
memory/3028-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3028-44-0x0000000001D90000-0x0000000001DB1000-memory.dmp

Filesize
132KB

Download
memory/3028-152-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads