Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
04/06/2024, 01:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe
- Size 97KB
- Sample240604-cajvtsaa49
- SHA256 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4
- MD5 030fa3bf97e5b88d87b58c903525da62
- SHA1 5d0038963c27137e5e6f9f341608feecac78b74e
- SHA512 0af7a80d1778e57d23e016238b97300fe57b39f89fbc1afdec020599f5b02eaca1cff1b173abb6a6750a1d004dcc22081d5aa338a64a1974c3dc2cf3c81d0e74
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIe:J8dfX7y9DZ+N7eB+tIe
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe - Executes dropped EXE 12 IoCs
pid Process 3300 SVCHOST.EXE 1308 SVCHOST.EXE 952 SVCHOST.EXE 3156 SVCHOST.EXE 1168 SVCHOST.EXE 3704 SPOOLSV.EXE 2920 SVCHOST.EXE 512 SVCHOST.EXE 3372 SPOOLSV.EXE 5064 SPOOLSV.EXE 5104 SVCHOST.EXE 1448 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened for modification F:\Recycled\desktop.ini b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\E: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\X: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\T: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\G: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\I: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\R: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\J: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\N: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\O: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\M: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\V: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\W: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\S: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\K: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\P: b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\*\InfoTip = "prop:Type;Write;Size" b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4376 WINWORD.EXE 4376 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3704 SPOOLSV.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 3300 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE 952 SVCHOST.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 3300 SVCHOST.EXE 1308 SVCHOST.EXE 952 SVCHOST.EXE 3156 SVCHOST.EXE 1168 SVCHOST.EXE 3704 SPOOLSV.EXE 2920 SVCHOST.EXE 512 SVCHOST.EXE 3372 SPOOLSV.EXE 5064 SPOOLSV.EXE 5104 SVCHOST.EXE 1448 SPOOLSV.EXE 4376 WINWORD.EXE 4376 WINWORD.EXE 4376 WINWORD.EXE 4376 WINWORD.EXE 4376 WINWORD.EXE 4376 WINWORD.EXE 4376 WINWORD.EXE - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 4592 wrote to memory of 3300 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 81 PID 4592 wrote to memory of 3300 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 81 PID 4592 wrote to memory of 3300 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 81 PID 3300 wrote to memory of 1308 3300 SVCHOST.EXE 82 PID 3300 wrote to memory of 1308 3300 SVCHOST.EXE 82 PID 3300 wrote to memory of 1308 3300 SVCHOST.EXE 82 PID 3300 wrote to memory of 952 3300 SVCHOST.EXE 84 PID 3300 wrote to memory of 952 3300 SVCHOST.EXE 84 PID 3300 wrote to memory of 952 3300 SVCHOST.EXE 84 PID 952 wrote to memory of 3156 952 SVCHOST.EXE 85 PID 952 wrote to memory of 3156 952 SVCHOST.EXE 85 PID 952 wrote to memory of 3156 952 SVCHOST.EXE 85 PID 952 wrote to memory of 1168 952 SVCHOST.EXE 87 PID 952 wrote to memory of 1168 952 SVCHOST.EXE 87 PID 952 wrote to memory of 1168 952 SVCHOST.EXE 87 PID 952 wrote to memory of 3704 952 SVCHOST.EXE 88 PID 952 wrote to memory of 3704 952 SVCHOST.EXE 88 PID 952 wrote to memory of 3704 952 SVCHOST.EXE 88 PID 3704 wrote to memory of 2920 3704 SPOOLSV.EXE 89 PID 3704 wrote to memory of 2920 3704 SPOOLSV.EXE 89 PID 3704 wrote to memory of 2920 3704 SPOOLSV.EXE 89 PID 3704 wrote to memory of 512 3704 SPOOLSV.EXE 91 PID 3704 wrote to memory of 512 3704 SPOOLSV.EXE 91 PID 3704 wrote to memory of 512 3704 SPOOLSV.EXE 91 PID 3704 wrote to memory of 3372 3704 SPOOLSV.EXE 92 PID 3704 wrote to memory of 3372 3704 SPOOLSV.EXE 92 PID 3704 wrote to memory of 3372 3704 SPOOLSV.EXE 92 PID 3300 wrote to memory of 5064 3300 SVCHOST.EXE 93 PID 3300 wrote to memory of 5064 3300 SVCHOST.EXE 93 PID 3300 wrote to memory of 5064 3300 SVCHOST.EXE 93 PID 4592 wrote to memory of 5104 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 94 PID 4592 wrote to memory of 5104 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 94 PID 4592 wrote to memory of 5104 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 94 PID 4592 wrote to memory of 1448 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 95 PID 4592 wrote to memory of 1448 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 95 PID 4592 wrote to memory of 1448 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 95 PID 4592 wrote to memory of 4376 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 96 PID 4592 wrote to memory of 4376 4592 b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe"C:\Users\Admin\AppData\Local\Temp\b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1308
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3156
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1168
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2920
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:512
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3372
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5064
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5104
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1448
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b59022def0da4a8c1baea796dd1c8cfe472d432bfed3beb7f48b6e9e603a5eb4.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SPOOLSV.EXE
- Size 97KB
- SHA256 48a38d7355b48cc4f4089730f38389e931337b25d3206c50ba7de10994d52966
- MD5 d3649718bad862b0267e0b1d778f5cd2
- SHA1 4bebf89db7275e75f9b9ddbff2af85d40150bef0
- SHA512 6fbe2e11c6d4bd0b584cd878d79d8b43814a377eb50d8e304421b93c3724414c9fe136977bb975462674b98405411dcff00453427c5cf1fa7dd092e2f4949747
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIJ:J8dfX7y9DZ+N7eB+tIJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 3bb1cdbb1710f6488b80ca70df30d5f59304b58c542c9cb9f4dcffeb6a24db95
- MD5 f8df5cf7d54ec16a34eb7c6b42083dad
- SHA1 c31bd37a22b25bdc09e8a13c53b779771fcf7276
- SHA512 8ed226f6ac83b5db19b8d7fc643c5668813679009ccdcc4458a42e18eef1f575713c9bf704ca4e746c7a8a7a29bc07da93da2c3a56010b506756cc0137ee0b94
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI1:J8dfX7y9DZ+N7eB+tI1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 2KB
- SHA256 2661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
- MD5 1a1dce35d60d2c70ca8894954fd5d384
- SHA1 58547dd65d506c892290755010d0232da34ee000
- SHA512 4abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TCD7FA3.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 ffc28fe1c8787a385e763bff8d3dca4ad5096cbc9102631386fbcd8942c33589
- MD5 8627f146500b97a81f5cc9f21f2c112e
- SHA1 b2829096425d1919d8b8243b884ae3118eeb14e7
- SHA512 e35aa8928c97ca8762e83b07c91f5f5c98e1b2f5f01384e0c47f2a84e3930ecde9c213d03a3cdf2531b0655ed7a3df955f67cab13ba0b3fb4300f668ac0759cb
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIm:J8dfX7y9DZ+N7eB+tIm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 52ca149dc2e8af5b52743ee9f21f1b4cb6591a8b7c45745a656cb938cd0f93fd
- MD5 52c58caaee8dce1814a70bf4a5a6f56f
- SHA1 eec96d5a700fae0e335230d4a0a6ea2b1b3fb514
- SHA512 33fecc5852e3f4b7d16423507f8c052e4e3b9cb91d21c2284691297af4752df5766a21e0ec0b189c0b3f0df04f24bd8814614b1a689b16181713e125b5b5d43c
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoI9:J8dfX7y9DZ+N7eB+tI9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Fonts\ Explorer.exe
- Size 97KB
- SHA256 7c6f2ffe88243550d3838ecb7b4babfdea0dace9084ed6a76215e2b0ae2114c3
- MD5 70825aa032b17e1811d3327ed81841b8
- SHA1 c08fcda687a68461de52be92a29a1fe6c95e64ea
- SHA512 864ee5a15b06fed12a9e638ae87bbbe504c23b4e16a9f5f990c7648d3e0e914e1a111eb32606046999e2437d8bca8bf828bbe5c0e02a9ca34cea4f987590c658
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIL:J8dfX7y9DZ+N7eB+tIL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path F:\Recycled\SVCHOST.EXE
- Size 97KB
- SHA256 1dfb0208a0dcd984d87e1a77b28a55809a4670fb3670a4d12bcf3505b136b059
- MD5 956cc451e532818823424c402a09729b
- SHA1 383a835603218eeaa666a20e31f46e60c2a40b54
- SHA512 fef9ef9aeec4f751281f12d183517ca10dec30abe83d550c6215e39829189f232364221fb9f8f6ef520010c682614ca99393dea9a60d6aa3c5016e0ae1f531b1
- SSDEEP 1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIo:J8dfX7y9DZ+N7eB+tIo
- MD5 SHA1 SHA512 SSDEEP