Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
26/05/2024, 18:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe
- Size 97KB
- Sample240526-w697fafe7x
- SHA256 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085
- MD5 39a25242cdcea4a75b03e0ceb0230ec1
- SHA1 b3a9980b5f2760ff7921485f0879d5eb17d25dd4
- SHA512 26a13f210c12b8e628dc43d0e58e61fda130186d680706a1b4a39882a461326871013fb86dd4c9d8cb12c61dcc649bb66a814fcab7b18275ecbfbe818f95130f
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIm:J8dfX7y9DZ+N7eB+tIm
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe - Executes dropped EXE 12 IoCs
pid Process 2620 SVCHOST.EXE 1236 SVCHOST.EXE 2592 SVCHOST.EXE 2312 SVCHOST.EXE 4844 SVCHOST.EXE 4860 SPOOLSV.EXE 848 SVCHOST.EXE 4220 SVCHOST.EXE 2192 SPOOLSV.EXE 4496 SPOOLSV.EXE 4724 SVCHOST.EXE 3232 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened for modification F:\Recycled\desktop.ini 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\I: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\E: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\R: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\U: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\N: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\Y: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\M: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\V: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\K: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\S: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\G: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\Q: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\T: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\Z: 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 29 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\QuickTip = "prop:Type;Size" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\TileInfo = "prop:Type;Size" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3044 WINWORD.EXE 3044 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 4860 SPOOLSV.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2620 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE 2592 SVCHOST.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 2620 SVCHOST.EXE 1236 SVCHOST.EXE 2592 SVCHOST.EXE 2312 SVCHOST.EXE 4844 SVCHOST.EXE 4860 SPOOLSV.EXE 848 SVCHOST.EXE 4220 SVCHOST.EXE 2192 SPOOLSV.EXE 4496 SPOOLSV.EXE 4724 SVCHOST.EXE 3232 SPOOLSV.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE 3044 WINWORD.EXE - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3092 wrote to memory of 2620 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 83 PID 3092 wrote to memory of 2620 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 83 PID 3092 wrote to memory of 2620 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 83 PID 2620 wrote to memory of 1236 2620 SVCHOST.EXE 84 PID 2620 wrote to memory of 1236 2620 SVCHOST.EXE 84 PID 2620 wrote to memory of 1236 2620 SVCHOST.EXE 84 PID 2620 wrote to memory of 2592 2620 SVCHOST.EXE 85 PID 2620 wrote to memory of 2592 2620 SVCHOST.EXE 85 PID 2620 wrote to memory of 2592 2620 SVCHOST.EXE 85 PID 2592 wrote to memory of 2312 2592 SVCHOST.EXE 86 PID 2592 wrote to memory of 2312 2592 SVCHOST.EXE 86 PID 2592 wrote to memory of 2312 2592 SVCHOST.EXE 86 PID 2592 wrote to memory of 4844 2592 SVCHOST.EXE 87 PID 2592 wrote to memory of 4844 2592 SVCHOST.EXE 87 PID 2592 wrote to memory of 4844 2592 SVCHOST.EXE 87 PID 2592 wrote to memory of 4860 2592 SVCHOST.EXE 88 PID 2592 wrote to memory of 4860 2592 SVCHOST.EXE 88 PID 2592 wrote to memory of 4860 2592 SVCHOST.EXE 88 PID 4860 wrote to memory of 848 4860 SPOOLSV.EXE 89 PID 4860 wrote to memory of 848 4860 SPOOLSV.EXE 89 PID 4860 wrote to memory of 848 4860 SPOOLSV.EXE 89 PID 4860 wrote to memory of 4220 4860 SPOOLSV.EXE 91 PID 4860 wrote to memory of 4220 4860 SPOOLSV.EXE 91 PID 4860 wrote to memory of 4220 4860 SPOOLSV.EXE 91 PID 4860 wrote to memory of 2192 4860 SPOOLSV.EXE 92 PID 4860 wrote to memory of 2192 4860 SPOOLSV.EXE 92 PID 4860 wrote to memory of 2192 4860 SPOOLSV.EXE 92 PID 2620 wrote to memory of 4496 2620 SVCHOST.EXE 93 PID 2620 wrote to memory of 4496 2620 SVCHOST.EXE 93 PID 2620 wrote to memory of 4496 2620 SVCHOST.EXE 93 PID 3092 wrote to memory of 4724 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 94 PID 3092 wrote to memory of 4724 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 94 PID 3092 wrote to memory of 4724 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 94 PID 3092 wrote to memory of 3232 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 95 PID 3092 wrote to memory of 3232 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 95 PID 3092 wrote to memory of 3232 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 95 PID 3092 wrote to memory of 3044 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 98 PID 3092 wrote to memory of 3044 3092 0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe"C:\Users\Admin\AppData\Local\Temp\0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1236
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2312
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4844
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:848
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4220
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2192
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4496
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4724
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3232
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0bc889019afae9d8f0abd4d4f24bd8dbacdaf13ac078f42b3cc4bb0a41c40085.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 5e3fe81a8c55b7c290699859b178e4c704674efbaaf7e707c653e779b2f4a6d3
- MD5 545fe533c0e49d56b6139ce7d642153b
- SHA1 b2fb16eb2102c9a3cf61421a6ceacf69919b5daf
- SHA512 4826d32b9eee38f2ecbcf1ea2b16a545d813003736dd45942569773fcfe7b405eb23a1e73d1f0fa01e7e8860d1de5495accc8a460a3b017124333406260f3832
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIr:J8dfX7y9DZ+N7eB+tIr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 2KB
- SHA256 2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
- MD5 1a1dce35d60d2c70ca8894954fd5d384
- SHA1 58547dd65d506c892290755010d0232da34ee000
- SHA512 4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 08be26c1b06afd5f61feb3277d1594b8de14331f92a8c538158ee7a22918dfd2
- MD5 9c54d49545783978c67fdc7f1e74421c
- SHA1 c18112cb8ff1d6c90e148ed28e006a02706b401e
- SHA512 3a2ecb8fa26235dfd6f80c8ae8861dbdb7d0f921b4719fcf567fdefc148a45b4e411b0fd1f8fc881f804b5c3f4696a7b430f42bcfebe1411f10d3ce68081dfbd
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIU:J8dfX7y9DZ+N7eB+tIU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 8f65a5365af74d3ff05b56e87fe60a7274dbd191cc5c8a7c5a604fee78df25fd
- MD5 672846940df780e53a737ee047b37729
- SHA1 9ceab14b7efc7960c41d08e39b1dca81fed13ac2
- SHA512 a9984a2508f6ad3a4a963bb6261bf96dd495facf5824f0c633bfd58a2d7fbcfb67739bf55b367f95b541351bf8ac90714897ee75b8b32b8aea275289f983c0b3
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI9:J8dfX7y9DZ+N7eB+tI9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 6edb32a6ab798be18a4286c848b603b7518c6b8a206db7e8c1ffffe0ebb13cb7
- MD5 4d2d217a91f838087bb52849ac365ef5
- SHA1 1ec529c37b7fc552627fec49391de8937d1e771d
- SHA512 0e93682e2fca5e95db4ba416e1d1463e1010203ea0e52e1fd6e222d20dc34a441645709efc877aa71b5f7559b96e0841c6734ed63ddc0bc30dd5494d7e9af3e1
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIJ:J8dfX7y9DZ+N7eB+tIJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path C:\recycled\SPOOLSV.EXE
- Size 97KB
- SHA256 e2d4fde4298ea927af75ef07f8379ccabc8257d0a964dac8069f26d9aa554766
- MD5 fd5001bad0eb889dd76125d6a2d36457
- SHA1 7a63bd992fbe57d4805bc4210dee3cc694633e7d
- SHA512 9410f1599871114db6d229ce118ff9f6d8e9d548493618982030c53ed257544409d5646d3f7290905b2bb2eaee93bcff1967da07a35eb8eec43e86d8c4a2b4b0
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIC:J8dfX7y9DZ+N7eB+tIC
- MD5 SHA1 SHA512 SSDEEP
- Path F:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 155ad6ca5eae2b8801be76ae99a0a8e8fb3fe0a849209d9c9e620bac5e61301a
- MD5 b30a1ed574c2a0b06ce6fde269a7a40c
- SHA1 d3f626f002e095d82e328086f225ef1513c7806f
- SHA512 11d613cbbd946d9aebff3d6105ade36651b66fc2068c3089975b48f86a048d16f2b159f7e74afb365e12dd22a818fe11a79f82c81bd84415b5c5c8d1f166a323
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIR:J8dfX7y9DZ+N7eB+tIR
- MD5 SHA1 SHA512 SSDEEP