Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
26/05/2024, 18:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe
- Size 97KB
- Sample240526-w697fafe7x
- SHA256 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085
- MD5 39a25242cdcea4a75b03e0ceb0230ec1
- SHA1 b3a9980b5f2760ff7921485f0879d5eb17d25dd4
- SHA512 26a13f210c12b8e628dc43d0e58e61fda130186d680706a1b4a39882a461326871013fb86dd4c9d8cb12c61dcc649bb66a814fcab7b18275ecbfbe818f95130f
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIm:J8dfX7y9DZ+N7eB+tIm
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe - Executes dropped EXE 12 IoCs
pid Process 3000 SVCHOST.EXE 2580 SVCHOST.EXE 2544 SVCHOST.EXE 2448 SVCHOST.EXE 2480 SVCHOST.EXE 2444 SPOOLSV.EXE 1804 SVCHOST.EXE 1860 SVCHOST.EXE 2744 SPOOLSV.EXE 2872 SPOOLSV.EXE 2900 SVCHOST.EXE 2148 SPOOLSV.EXE - Loads dropped DLL 21 IoCs
pid Process 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened for modification F:\Recycled\desktop.ini 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\N: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\T: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\U: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\X: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\O: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\V: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\H: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\E: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\Y: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\G: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\S: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\P: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\Z: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\I: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\K: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\R: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2308 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2544 SVCHOST.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 2444 SPOOLSV.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE 3000 SVCHOST.EXE - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3000 SVCHOST.EXE 2580 SVCHOST.EXE 2544 SVCHOST.EXE 2448 SVCHOST.EXE 2480 SVCHOST.EXE 2444 SPOOLSV.EXE 1804 SVCHOST.EXE 1860 SVCHOST.EXE 2744 SPOOLSV.EXE 2872 SPOOLSV.EXE 2900 SVCHOST.EXE 2148 SPOOLSV.EXE 2308 WINWORD.EXE 2308 WINWORD.EXE - Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2860 wrote to memory of 3000 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 28 PID 2860 wrote to memory of 3000 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 28 PID 2860 wrote to memory of 3000 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 28 PID 2860 wrote to memory of 3000 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 28 PID 3000 wrote to memory of 2580 3000 SVCHOST.EXE 29 PID 3000 wrote to memory of 2580 3000 SVCHOST.EXE 29 PID 3000 wrote to memory of 2580 3000 SVCHOST.EXE 29 PID 3000 wrote to memory of 2580 3000 SVCHOST.EXE 29 PID 3000 wrote to memory of 2544 3000 SVCHOST.EXE 30 PID 3000 wrote to memory of 2544 3000 SVCHOST.EXE 30 PID 3000 wrote to memory of 2544 3000 SVCHOST.EXE 30 PID 3000 wrote to memory of 2544 3000 SVCHOST.EXE 30 PID 2544 wrote to memory of 2448 2544 SVCHOST.EXE 31 PID 2544 wrote to memory of 2448 2544 SVCHOST.EXE 31 PID 2544 wrote to memory of 2448 2544 SVCHOST.EXE 31 PID 2544 wrote to memory of 2448 2544 SVCHOST.EXE 31 PID 2544 wrote to memory of 2480 2544 SVCHOST.EXE 32 PID 2544 wrote to memory of 2480 2544 SVCHOST.EXE 32 PID 2544 wrote to memory of 2480 2544 SVCHOST.EXE 32 PID 2544 wrote to memory of 2480 2544 SVCHOST.EXE 32 PID 2544 wrote to memory of 2444 2544 SVCHOST.EXE 33 PID 2544 wrote to memory of 2444 2544 SVCHOST.EXE 33 PID 2544 wrote to memory of 2444 2544 SVCHOST.EXE 33 PID 2544 wrote to memory of 2444 2544 SVCHOST.EXE 33 PID 2444 wrote to memory of 1804 2444 SPOOLSV.EXE 34 PID 2444 wrote to memory of 1804 2444 SPOOLSV.EXE 34 PID 2444 wrote to memory of 1804 2444 SPOOLSV.EXE 34 PID 2444 wrote to memory of 1804 2444 SPOOLSV.EXE 34 PID 2444 wrote to memory of 1860 2444 SPOOLSV.EXE 35 PID 2444 wrote to memory of 1860 2444 SPOOLSV.EXE 35 PID 2444 wrote to memory of 1860 2444 SPOOLSV.EXE 35 PID 2444 wrote to memory of 1860 2444 SPOOLSV.EXE 35 PID 2444 wrote to memory of 2744 2444 SPOOLSV.EXE 36 PID 2444 wrote to memory of 2744 2444 SPOOLSV.EXE 36 PID 2444 wrote to memory of 2744 2444 SPOOLSV.EXE 36 PID 2444 wrote to memory of 2744 2444 SPOOLSV.EXE 36 PID 3000 wrote to memory of 2872 3000 SVCHOST.EXE 37 PID 3000 wrote to memory of 2872 3000 SVCHOST.EXE 37 PID 3000 wrote to memory of 2872 3000 SVCHOST.EXE 37 PID 3000 wrote to memory of 2872 3000 SVCHOST.EXE 37 PID 2860 wrote to memory of 2900 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 38 PID 2860 wrote to memory of 2900 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 38 PID 2860 wrote to memory of 2900 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 38 PID 2860 wrote to memory of 2900 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 38 PID 2860 wrote to memory of 2148 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 39 PID 2860 wrote to memory of 2148 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 39 PID 2860 wrote to memory of 2148 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 39 PID 2860 wrote to memory of 2148 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 39 PID 2860 wrote to memory of 2308 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 40 PID 2860 wrote to memory of 2308 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 40 PID 2860 wrote to memory of 2308 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 40 PID 2860 wrote to memory of 2308 2860 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 40 PID 2308 wrote to memory of 2800 2308 WINWORD.EXE 43 PID 2308 wrote to memory of 2800 2308 WINWORD.EXE 43 PID 2308 wrote to memory of 2800 2308 WINWORD.EXE 43 PID 2308 wrote to memory of 2800 2308 WINWORD.EXE 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe"C:\Users\Admin\AppData\Local\Temp\0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2580
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2448
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2480
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1804
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1860
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2744
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2872
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2900
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2148
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2800
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 2KB
- SHA256 2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
- MD5 1a1dce35d60d2c70ca8894954fd5d384
- SHA1 58547dd65d506c892290755010d0232da34ee000
- SHA512 4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
- MD5 SHA1 SHA512
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 7e6e5284a537f2cde283da42b3caabe273245e299f7ab8d4d47ed6e5f730b6c1
- MD5 edc34facc5bda0eda6872dbd4a5e9a05
- SHA1 076ae516363b612b32226446ef11c9ab37d22bf5
- SHA512 391d48720bfc88c91cdb69bf0544bf734e8630556de53d6d48fe4207489f5b962eefc95ac7e70f21ab502093891c4164b723fa49669caca63b0d4b26f476dfbf
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIq:J8dfX7y9DZ+N7eB+tIq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 579f204e537354b0e4bf11f7aed2033437fd17535854d7f0f95fa8ce9eff10e3
- MD5 64b0fbd1f826fd2f6168ba8d1af988dc
- SHA1 ae65ea80af0977627a0b07068064902fee9f8018
- SHA512 8308277c050e3527e2dbf8efc5e2f746429c885d48b31658a78f19eb1056a718b9a42b3781a3b964e72df681b568b339918e8ef45a99498980774acc359b1600
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIN:J8dfX7y9DZ+N7eB+tIN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 218f89df94336f47a3c0e23a796d08e4d410ab3f4ac7755753b618083444b576
- MD5 57b27078a6ad79e7af0182db4911fff7
- SHA1 75223ee5af30118e67e661c354ba4e22a3db1d4f
- SHA512 7ac98f2b009c3b1aadc1da9899ff6eebc79def2eaf4b172fe7ed0d37a30279adbc134ae47b00482cf1dd3513247adc2bbd016b31146390430194267e496814aa
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIi:J8dfX7y9DZ+N7eB+tIi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path C:\recycled\SPOOLSV.EXE
- Size 97KB
- SHA256 192e6a9fc8777be9d42bfa43731b86f393f2723c599345e021aedb8a3f756ac5
- MD5 1fb6ae00a1d2fa4cf26e860b2f417218
- SHA1 fea4a51bf7377da45bcb551d320d98ec59ffa64a
- SHA512 8eb4a6a787b0b4ecdde3c88e369db9c9968bacdeab8886d6fb9b152c4a581c43caaae3359b13d7b026833ac4bc3212513a8db879550cefc626ab21933b42ccd5
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIc:J8dfX7y9DZ+N7eB+tIc
- MD5 SHA1 SHA512 SSDEEP
- Path F:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 dc7faa2fc3384fed51f5afbf1c6b2921ae0c0a93eb8da9fb66a6440cf786bdb3
- MD5 49b4060c0d836eb120c7f3dd62350d9d
- SHA1 474163f95a1e1c6cf8662a931dedbd238b1ac8b8
- SHA512 99c68c6c2b18bfa3b2711995ae7dbd7c4fdc31fdb4deddc6355216010c6d7448447fb606ff594538a65102e7b505ce7c9382caf57ca66b6ca441df75e5c97843
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIq:J8dfX7y9DZ+N7eB+tIq
- MD5 SHA1 SHA512 SSDEEP
- Path \Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 91a2190392a91d18714070a41055a71507cf001b510ad1c2b8907592f572e05f
- MD5 6da53745d60e98ae20501227ff2fae7e
- SHA1 64249a350490d07c16a8a4d711666700185120fa
- SHA512 f45a7626e2586d16689c8fc5d40a74d1d5e91622e78019b3bf8416b2597d706653bcf433dda5b96183e6e87db55ed56e993264e44604d2cacfbddf4e7ac233c7
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIa:J8dfX7y9DZ+N7eB+tIa
- MD5 SHA1 SHA512 SSDEEP