Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 19:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe
Resource
win7-20240508-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe
-
Size
97KB
-
MD5
a5cbea3acae6f4a1d68f82c4cc1d9630
-
SHA1
05a9052c61aa0d11340895d4da0c905ca3be971b
-
SHA256
e2a08b9be32f229af214ef7a8927ba465dee805b53724bc40fc2308d93be5481
-
SHA512
12d0e599c59858cf382dba87f78eb76021e2fae7af5a30f8a5ad9a30122d1c56375533ca9a28fff21e5b5c48d0e1c93270e6e58724317b2a714d9539d0539e65
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIw:J8dfX7y9DZ+N7eB+tIw
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe -
Executes dropped EXE 12 IoCs
pid Process 1056 SVCHOST.EXE 4948 SVCHOST.EXE 1824 SVCHOST.EXE 4028 SVCHOST.EXE 4712 SVCHOST.EXE 4492 SPOOLSV.EXE 2064 SVCHOST.EXE 552 SVCHOST.EXE 2056 SPOOLSV.EXE 2880 SPOOLSV.EXE 5044 SVCHOST.EXE 3816 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened for modification F:\Recycled\desktop.ini virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\O: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\T: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\K: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\Z: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\P: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\Y: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\S: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\U: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\J: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\Q: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\W: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\X: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\L: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\V: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\M: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\E: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\I: virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2616 WINWORD.EXE 2616 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 4492 SPOOLSV.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1056 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE 1824 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 1056 SVCHOST.EXE 4948 SVCHOST.EXE 1824 SVCHOST.EXE 4028 SVCHOST.EXE 4712 SVCHOST.EXE 4492 SPOOLSV.EXE 2064 SVCHOST.EXE 552 SVCHOST.EXE 2056 SPOOLSV.EXE 2880 SPOOLSV.EXE 5044 SVCHOST.EXE 3816 SPOOLSV.EXE 2616 WINWORD.EXE 2616 WINWORD.EXE 2616 WINWORD.EXE 2616 WINWORD.EXE 2616 WINWORD.EXE 2616 WINWORD.EXE 2616 WINWORD.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3772 wrote to memory of 1056 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 83 PID 3772 wrote to memory of 1056 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 83 PID 3772 wrote to memory of 1056 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 83 PID 1056 wrote to memory of 4948 1056 SVCHOST.EXE 84 PID 1056 wrote to memory of 4948 1056 SVCHOST.EXE 84 PID 1056 wrote to memory of 4948 1056 SVCHOST.EXE 84 PID 1056 wrote to memory of 1824 1056 SVCHOST.EXE 85 PID 1056 wrote to memory of 1824 1056 SVCHOST.EXE 85 PID 1056 wrote to memory of 1824 1056 SVCHOST.EXE 85 PID 1824 wrote to memory of 4028 1824 SVCHOST.EXE 87 PID 1824 wrote to memory of 4028 1824 SVCHOST.EXE 87 PID 1824 wrote to memory of 4028 1824 SVCHOST.EXE 87 PID 1824 wrote to memory of 4712 1824 SVCHOST.EXE 88 PID 1824 wrote to memory of 4712 1824 SVCHOST.EXE 88 PID 1824 wrote to memory of 4712 1824 SVCHOST.EXE 88 PID 1824 wrote to memory of 4492 1824 SVCHOST.EXE 89 PID 1824 wrote to memory of 4492 1824 SVCHOST.EXE 89 PID 1824 wrote to memory of 4492 1824 SVCHOST.EXE 89 PID 4492 wrote to memory of 2064 4492 SPOOLSV.EXE 91 PID 4492 wrote to memory of 2064 4492 SPOOLSV.EXE 91 PID 4492 wrote to memory of 2064 4492 SPOOLSV.EXE 91 PID 4492 wrote to memory of 552 4492 SPOOLSV.EXE 92 PID 4492 wrote to memory of 552 4492 SPOOLSV.EXE 92 PID 4492 wrote to memory of 552 4492 SPOOLSV.EXE 92 PID 4492 wrote to memory of 2056 4492 SPOOLSV.EXE 93 PID 4492 wrote to memory of 2056 4492 SPOOLSV.EXE 93 PID 4492 wrote to memory of 2056 4492 SPOOLSV.EXE 93 PID 1056 wrote to memory of 2880 1056 SVCHOST.EXE 95 PID 1056 wrote to memory of 2880 1056 SVCHOST.EXE 95 PID 1056 wrote to memory of 2880 1056 SVCHOST.EXE 95 PID 3772 wrote to memory of 5044 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 96 PID 3772 wrote to memory of 5044 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 96 PID 3772 wrote to memory of 5044 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 96 PID 3772 wrote to memory of 3816 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 97 PID 3772 wrote to memory of 3816 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 97 PID 3772 wrote to memory of 3816 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 97 PID 3772 wrote to memory of 2616 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 98 PID 3772 wrote to memory of 2616 3772 virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4948
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4028
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4712
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2064
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:552
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2056
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2880
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3816
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\virussign.com_a5cbea3acae6f4a1d68f82c4cc1d9630.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD577a0fe42008a39b62538bb8bbd560ed1
SHA1c93333250191a0e68e4ff39f3683cc3729d7c113
SHA256704980958654163ac057f448e5bd60ce0c68813a3875a1924b47ce1cf2b46b9a
SHA512c914b54abd3701cbcd390783d8c63063d6a9f05d312d38858a1b8e79b29ebb6b4cfd33b11faf36e89b38b6b1a51d6b48ef16e752c187734a42485ec72a1e58c2
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
97KB
MD526e7bea722353ee44694df5753e354de
SHA1eab3b28d79a423b6078117f8ab6b7c1e13ddba12
SHA2564ed112d5d9c241f015180dc2352643e217e468f552cb6a820553ed1d6f0e2fdd
SHA512cb673b198e0d16a5f90dcfd86ee014ac68a2a0aa082fad811720308fcf726e248494f8d2a43640210cf01675d5c006c1da178f40201af959516bd4d3f41114e8
-
Filesize
97KB
MD576fd1833183ecbadf35e19e1c608b285
SHA1ce640c6c1caf10cf949cfb4cf0afa340b9d29075
SHA256ff6daddec860503b1eadd9dfbd3f4b7cf42cc07545d544198593715643cd8066
SHA51224b33fe8ce443bc46d5c4552e31f90cd526760778fee1ca5cc0a6385e9769768b3004855a699cd8835827f87c93afceadf6c28fdff23a94c82ad0a775f89975c
-
Filesize
97KB
MD55c4b8287b3bfc850a3b8abfd973843f3
SHA12e8f166a4ce049735ebaf22e3578cf407983d6fb
SHA256d334a4a1093eb1652c6b97b647b86308c62b398a38691e8522ea042edb1a5a3d
SHA5121f96c866165977bbd7a2732193a7f4a0eead72735ace529c50562095161b8e8b91cc616722cdd174d65de8a5f8c1d6542a4d4396bdbba9e899ddd0d5a37887e8
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD5f33d9c0178428027c087e291d85e2976
SHA12e5d270ced5b49b9881a482a193044327f27c8d9
SHA2567889f198ceafc15d769ed7c1293099505ec7049b349f3ad5aec50c7c4b96b2c5
SHA512fab4e5a12de2ab4a9b83896f7cad29b94416bab9ca32bbb3afa9b4d744bef0585abe2d0cc10528ad577b5b334352872408f8266cbb6e9b32248932335ffc28ab
-
Filesize
97KB
MD5230f8ef65fcd9891d79f1288c41529ff
SHA1d33c9aaca51dc286c524cb86f379bd92f355d8e1
SHA25677fc8611b5cf3fc75420de33b472ad053841efda988ce8f4fd93f715db9ab8c3
SHA512d9b67400cbda07a3b9e3c884c1f8e6dc085fdbedc68760bfd12ee2ab0bb071788df358507664d79a4da9abed5f05895a01a43a7208bf92cff1ab0677c79483a4