Analysis
-
max time kernel
113s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/06/2024, 14:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe
-
Size
97KB
-
MD5
e611c15ff5e7b99b01ebf31a59b6fe1a
-
SHA1
f4ae04eebbd22b0db92d996c86845bf623972587
-
SHA256
fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6
-
SHA512
91f79d875f0122aa8285445ede8ba978a727747e7ba0b65d316fe6a39ba88fe8214e54c64e1996411772a2f961f727a3d7b82784abbecc0bf19b441f996a9ae1
-
SSDEEP
1536:4a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3YdoIc:J8dfX7y9DZ+N7eB+tIc
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe -
Executes dropped EXE 15 IoCs
pid Process 724 SVCHOST.EXE 2704 SVCHOST.EXE 4056 SVCHOST.EXE 3452 SVCHOST.EXE 2068 SVCHOST.EXE 1864 SPOOLSV.EXE 3504 SVCHOST.EXE 2268 SVCHOST.EXE 900 SPOOLSV.EXE 4288 SPOOLSV.EXE 2476 SVCHOST.EXE 3080 SPOOLSV.EXE 4176 SVCHOST.EXE 3436 SVCHOST.EXE 2376 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened for modification F:\Recycled\desktop.ini fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\Z: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\R: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\Y: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\N: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\P: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\G: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\M: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\L: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\E: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\W: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\Q: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\O: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\X: fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\TileInfo = "prop:Type;Size" fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\QuickTip = "prop:Type;Size" fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\InfoTip = "prop:Type;Write;Size" fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4244 WINWORD.EXE 4244 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 4056 SVCHOST.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 724 SVCHOST.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE 1864 SPOOLSV.EXE 1864 SPOOLSV.EXE 4056 SVCHOST.EXE 4056 SVCHOST.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4244 WINWORD.EXE 4244 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 724 SVCHOST.EXE 2704 SVCHOST.EXE 4056 SVCHOST.EXE 3452 SVCHOST.EXE 2068 SVCHOST.EXE 1864 SPOOLSV.EXE 3504 SVCHOST.EXE 2268 SVCHOST.EXE 900 SPOOLSV.EXE 4288 SPOOLSV.EXE 2476 SVCHOST.EXE 3080 SPOOLSV.EXE 4176 SVCHOST.EXE 3436 SVCHOST.EXE 2376 SPOOLSV.EXE 4244 WINWORD.EXE 4244 WINWORD.EXE 4244 WINWORD.EXE 4244 WINWORD.EXE 4244 WINWORD.EXE 4244 WINWORD.EXE 4244 WINWORD.EXE -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 3372 wrote to memory of 724 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 93 PID 3372 wrote to memory of 724 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 93 PID 3372 wrote to memory of 724 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 93 PID 724 wrote to memory of 2704 724 SVCHOST.EXE 94 PID 724 wrote to memory of 2704 724 SVCHOST.EXE 94 PID 724 wrote to memory of 2704 724 SVCHOST.EXE 94 PID 724 wrote to memory of 4056 724 SVCHOST.EXE 95 PID 724 wrote to memory of 4056 724 SVCHOST.EXE 95 PID 724 wrote to memory of 4056 724 SVCHOST.EXE 95 PID 4056 wrote to memory of 3452 4056 SVCHOST.EXE 96 PID 4056 wrote to memory of 3452 4056 SVCHOST.EXE 96 PID 4056 wrote to memory of 3452 4056 SVCHOST.EXE 96 PID 4056 wrote to memory of 2068 4056 SVCHOST.EXE 97 PID 4056 wrote to memory of 2068 4056 SVCHOST.EXE 97 PID 4056 wrote to memory of 2068 4056 SVCHOST.EXE 97 PID 4056 wrote to memory of 1864 4056 SVCHOST.EXE 98 PID 4056 wrote to memory of 1864 4056 SVCHOST.EXE 98 PID 4056 wrote to memory of 1864 4056 SVCHOST.EXE 98 PID 1864 wrote to memory of 3504 1864 SPOOLSV.EXE 99 PID 1864 wrote to memory of 3504 1864 SPOOLSV.EXE 99 PID 1864 wrote to memory of 3504 1864 SPOOLSV.EXE 99 PID 1864 wrote to memory of 2268 1864 SPOOLSV.EXE 100 PID 1864 wrote to memory of 2268 1864 SPOOLSV.EXE 100 PID 1864 wrote to memory of 2268 1864 SPOOLSV.EXE 100 PID 1864 wrote to memory of 900 1864 SPOOLSV.EXE 101 PID 1864 wrote to memory of 900 1864 SPOOLSV.EXE 101 PID 1864 wrote to memory of 900 1864 SPOOLSV.EXE 101 PID 724 wrote to memory of 4288 724 SVCHOST.EXE 102 PID 724 wrote to memory of 4288 724 SVCHOST.EXE 102 PID 724 wrote to memory of 4288 724 SVCHOST.EXE 102 PID 3372 wrote to memory of 2476 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 103 PID 3372 wrote to memory of 2476 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 103 PID 3372 wrote to memory of 2476 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 103 PID 3372 wrote to memory of 3080 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 104 PID 3372 wrote to memory of 3080 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 104 PID 3372 wrote to memory of 3080 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 104 PID 3372 wrote to memory of 4176 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 105 PID 3372 wrote to memory of 4176 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 105 PID 3372 wrote to memory of 4176 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 105 PID 3372 wrote to memory of 3436 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 106 PID 3372 wrote to memory of 3436 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 106 PID 3372 wrote to memory of 3436 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 106 PID 3372 wrote to memory of 2376 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 107 PID 3372 wrote to memory of 2376 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 107 PID 3372 wrote to memory of 2376 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 107 PID 3372 wrote to memory of 4244 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 108 PID 3372 wrote to memory of 4244 3372 fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe"C:\Users\Admin\AppData\Local\Temp\fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:724 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2704
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3452
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2068
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3504
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2268
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4288
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2476
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3080
-
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4176
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3436
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2376
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fee73420c6e42d686d96bbf461d312bb999d1f916c9b33d9a85bd6d83870d2e6.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵PID:4632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5004342f67ee9a78d8474dbfae0d3cdac
SHA11b3b53a18e60775c120465caf906d35ad09a3ad5
SHA256358986039fd476afad9ec492bffa60e2169a4c2b6be8da9c3fc611ac2a8fb70c
SHA512f46059f7b616b44bf13a124579d319dcff41e78d459fb0198f688550ecde860559871a38353d4baa93130151f5170fd73d68fba24bada2840913d1cf9fd09086
-
Filesize
97KB
MD5ac0727ac5974c0a161abf8ef966498f4
SHA18317e26f2b1ed75828a2b76d3fcc944a414101ed
SHA2561e3eb0e2dde98dcbaaf8e1a11f296eb7ad4d65817b8606445f929cd600e3e25e
SHA512d8bb8c05c34eb5854dfee1d7c721c745401aac05fcb2a860e4a0ff185741b8dab2bc061f07faf01e97b2de8f16843ff635e2cdcdb4d3d07cbc7c12498174125a
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
97KB
MD544b3fe5f304e3c4bea4d1d309b71ca0f
SHA1acfa346c4eb8a7760d0cbffee4be58a7e8edd6df
SHA256a917a1401d4238607c2c349a21b4300419494ed677b227d7efb869ddaf0a48b1
SHA51253f891766405afc4459bff0a86c6b89bbe9d1e97b99c781ab9c8f026e97d22dec816eb04b960c1ac0f85be38a39b526825e637cfc0334e42951c2e22a0b30958
-
Filesize
97KB
MD5a36df884ef08697835b984b9d552c8e3
SHA1d5737ec12f5dd416260cb78513fd23c5596d21f5
SHA256f637a3d0e7d4a182d0ef28b756a0f8b8b4ed09122f41b0dd6bee959aac224339
SHA512187741bccd9f8a524842991cd6cbc48a63ad5a58ed2229e1916c7945003d29686faf0bd1afd7575e60641eb78f244e531a88e75e42e57fb5c48f654d504650f0
-
Filesize
97KB
MD5313449aaa285c8c9df39a36c23188737
SHA18a33a5de840103919e8fc4d08a14f21a0a7913dd
SHA2562c399b97aa06dc8b9d79fd287927b6eff1b263a09efc6206377d2b7a5e2778e9
SHA5127d669b8d469a2025766caab0a115836f3a9a29a95ce640e7e76d3b0c76321b05c7a8fb9b87122c4dc5b72abb74dbfa263e9b08bc458b905be663c1eccd3feaff
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
97KB
MD50a816783852504a9a03eca89a391fb3c
SHA143660c9218258379cb3171e282e9089929fdc7f0
SHA25667c4bcd437dbe877382f15898e7a556f646653b840ad529ac2971066a6cfabab
SHA512f858c7e6fca1c58018db6b0b9e2a6ac66c534efae15937ec237765e4da004f7f37226a93528e83772b24655bfe01a2ec06b61546c2f7515d5c227a930589e392