Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 18:21
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe
Resource
win7-20240220-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe
-
Size
89KB
-
MD5
65191e0dc05876a36f10d70c851e81a4
-
SHA1
042cbb5b36e36955470b9494a07cc9b816de33bd
-
SHA256
0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c
-
SHA512
6ca2205b4281ffd21f49522952fdfffca80c89e7b88cf6f89277c11ab43bbb5133e18722062581e47df4452337496ad534343e79c0e1c799670d4675ec131976
-
SSDEEP
1536:71sMveb4lR0daHy9v7Zc86y9U4AFRfBWAEn9:BDeb4T0daHy9DZc86yGUtn9
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe -
Detects executables packed with ASPack 19 IoCs
resource yara_rule behavioral2/memory/4724-0-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000100000000002c-9.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00070000000233ef-16.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2848-17-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3584-28-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3188-31-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2240-39-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2388-42-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00070000000233f0-44.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1948-45-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4588-52-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4588-56-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/540-61-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2396-63-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/508-65-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/508-69-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4928-73-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1484-76-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4724-77-0x0000000000400000-0x000000000041A000-memory.dmp INDICATOR_EXE_Packed_ASPack -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe -
Executes dropped EXE 12 IoCs
pid Process 2848 SVCHOST.EXE 3584 SVCHOST.EXE 3188 SVCHOST.EXE 2240 SVCHOST.EXE 2388 SVCHOST.EXE 1948 SPOOLSV.EXE 4588 SVCHOST.EXE 540 SVCHOST.EXE 2396 SPOOLSV.EXE 508 SPOOLSV.EXE 4928 SVCHOST.EXE 1484 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened for modification F:\Recycled\desktop.ini 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\I: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\L: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\J: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\Y: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\T: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\G: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\Q: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\Z: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\N: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\V: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\E: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\O: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\P: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\S: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\K: 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\QuickTip = "prop:Type;Size" 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings Explorer.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\*\TileInfo = "prop:Type;Size" 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1888 WINWORD.EXE 1888 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 1948 SPOOLSV.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 2848 SVCHOST.EXE 3188 SVCHOST.EXE 3188 SVCHOST.EXE 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 3188 SVCHOST.EXE 3188 SVCHOST.EXE 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 3188 SVCHOST.EXE 3188 SVCHOST.EXE 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 3188 SVCHOST.EXE 3188 SVCHOST.EXE 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 2848 SVCHOST.EXE 3584 SVCHOST.EXE 3188 SVCHOST.EXE 2240 SVCHOST.EXE 2388 SVCHOST.EXE 1948 SPOOLSV.EXE 4588 SVCHOST.EXE 540 SVCHOST.EXE 2396 SPOOLSV.EXE 508 SPOOLSV.EXE 4928 SVCHOST.EXE 1484 SPOOLSV.EXE 1888 WINWORD.EXE 1888 WINWORD.EXE 1888 WINWORD.EXE 1888 WINWORD.EXE 1888 WINWORD.EXE 1888 WINWORD.EXE 1888 WINWORD.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 4724 wrote to memory of 2848 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 83 PID 4724 wrote to memory of 2848 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 83 PID 4724 wrote to memory of 2848 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 83 PID 2848 wrote to memory of 3584 2848 SVCHOST.EXE 84 PID 2848 wrote to memory of 3584 2848 SVCHOST.EXE 84 PID 2848 wrote to memory of 3584 2848 SVCHOST.EXE 84 PID 2848 wrote to memory of 3188 2848 SVCHOST.EXE 85 PID 2848 wrote to memory of 3188 2848 SVCHOST.EXE 85 PID 2848 wrote to memory of 3188 2848 SVCHOST.EXE 85 PID 3188 wrote to memory of 2240 3188 SVCHOST.EXE 86 PID 3188 wrote to memory of 2240 3188 SVCHOST.EXE 86 PID 3188 wrote to memory of 2240 3188 SVCHOST.EXE 86 PID 3188 wrote to memory of 2388 3188 SVCHOST.EXE 87 PID 3188 wrote to memory of 2388 3188 SVCHOST.EXE 87 PID 3188 wrote to memory of 2388 3188 SVCHOST.EXE 87 PID 3188 wrote to memory of 1948 3188 SVCHOST.EXE 88 PID 3188 wrote to memory of 1948 3188 SVCHOST.EXE 88 PID 3188 wrote to memory of 1948 3188 SVCHOST.EXE 88 PID 1948 wrote to memory of 4588 1948 SPOOLSV.EXE 90 PID 1948 wrote to memory of 4588 1948 SPOOLSV.EXE 90 PID 1948 wrote to memory of 4588 1948 SPOOLSV.EXE 90 PID 1948 wrote to memory of 540 1948 SPOOLSV.EXE 91 PID 1948 wrote to memory of 540 1948 SPOOLSV.EXE 91 PID 1948 wrote to memory of 540 1948 SPOOLSV.EXE 91 PID 1948 wrote to memory of 2396 1948 SPOOLSV.EXE 93 PID 1948 wrote to memory of 2396 1948 SPOOLSV.EXE 93 PID 1948 wrote to memory of 2396 1948 SPOOLSV.EXE 93 PID 2848 wrote to memory of 508 2848 SVCHOST.EXE 94 PID 2848 wrote to memory of 508 2848 SVCHOST.EXE 94 PID 2848 wrote to memory of 508 2848 SVCHOST.EXE 94 PID 4724 wrote to memory of 4928 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 95 PID 4724 wrote to memory of 4928 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 95 PID 4724 wrote to memory of 4928 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 95 PID 4724 wrote to memory of 1484 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 97 PID 4724 wrote to memory of 1484 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 97 PID 4724 wrote to memory of 1484 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 97 PID 2848 wrote to memory of 4024 2848 SVCHOST.EXE 98 PID 2848 wrote to memory of 4024 2848 SVCHOST.EXE 98 PID 2848 wrote to memory of 4024 2848 SVCHOST.EXE 98 PID 4024 wrote to memory of 832 4024 userinit.exe 99 PID 4024 wrote to memory of 832 4024 userinit.exe 99 PID 4724 wrote to memory of 1888 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 100 PID 4724 wrote to memory of 1888 4724 0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe"C:\Users\Admin\AppData\Local\Temp\0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3584
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2240
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2388
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4588
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:540
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2396
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:508
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE4⤵
- Modifies registry class
PID:832
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4928
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1484
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0663610695c856638c9832f75ffc61b37a68ffb6c0ee702cc58f3b91fb124c6c.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5282e8ec44e3e4ec0e64972557644ee08
SHA118256a0c7c03e658e085470ba42a8e574a6f89f5
SHA25678cdcee6b37f7a02836c3886391f32753decc0cfedb6e831676a2d0d0b755ce4
SHA512fc50259b979b98c77fff38ced4ec2a39b2ea50b8f00379521e4e020b3b32c494686097e3796ff02a26298797576563491530a17a3b53c41e426df7c5756b9f23
-
Filesize
89KB
MD516798291c9820b01331d4ce72550e5c8
SHA18ccb128bd63bd772c7b820a9874d67908c97c422
SHA2561c2a933d491e26bd9954ea8e9ab51b2286a4d95449870fd581e530e2862d6228
SHA5129e59c6d19d962b56fae9cc5704d503056e79c4a64f614b0f0f5b60aef1834be3b597e869c9673e5ddec2826d8d3174fa9cfbed0d63c89eef3a95e92ca7b1b98e
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
89KB
MD567f00ffdf0ccbbe73a950e6d37609e70
SHA15828149963746b16cb22f0844e85ac017eeeb411
SHA256a1a43d34f6e8c0d81dd9a529e44853d1172cde21745cb52b671b7544d80821f8
SHA5126374af0355f3e1e64e20ca7e02cb47288ce0335fc2e3c0a8b9eae8327993aad1c7efe05f840c41f736680540209b0053fd60adb5e8271844a543a9592fbe269d