Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 20:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
17 signatures
150 seconds
General
-
Target
314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe
-
Size
76KB
-
MD5
6624244fb473d9c3a55a38c139dc49fb
-
SHA1
b232cacb27d7ccb00697d0c55733066205674b72
-
SHA256
314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685
-
SHA512
d782f2f737a7cc738763c6985a325a9d75c7ebbda63d13075ac92656428efa28e8fa5ac8b74fb19608b2a493340b2ea1a51da49926119868a447db60b58c603c
-
SSDEEP
1536:va3+ddygX7y9v7Z+NoykJHBOAFRfBjG3ldoIW:S8dfX7y9DZ+N7eB+IIW
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe -
Executes dropped EXE 12 IoCs
pid Process 2756 SVCHOST.EXE 2188 SVCHOST.EXE 2808 SVCHOST.EXE 2800 SVCHOST.EXE 2628 SVCHOST.EXE 2112 SPOOLSV.EXE 896 SVCHOST.EXE 2200 SVCHOST.EXE 2372 SPOOLSV.EXE 316 SPOOLSV.EXE 3036 SVCHOST.EXE 2916 SPOOLSV.EXE -
Loads dropped DLL 18 IoCs
pid Process 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification F:\Recycled\desktop.ini 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened for modification C:\Recycled\desktop.ini 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\M: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\H: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\T: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\X: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\N: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\P: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\E: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\O: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\Y: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\Z: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\K: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\R: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\V: 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL\COMMAND 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG\COMMAND 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3056 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2808 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2756 SVCHOST.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE 2112 SPOOLSV.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 2756 SVCHOST.EXE 2188 SVCHOST.EXE 2808 SVCHOST.EXE 2800 SVCHOST.EXE 2628 SVCHOST.EXE 2112 SPOOLSV.EXE 896 SVCHOST.EXE 2200 SVCHOST.EXE 2372 SPOOLSV.EXE 316 SPOOLSV.EXE 3036 SVCHOST.EXE 2916 SPOOLSV.EXE 3056 WINWORD.EXE 3056 WINWORD.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2756 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 29 PID 2452 wrote to memory of 2756 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 29 PID 2452 wrote to memory of 2756 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 29 PID 2452 wrote to memory of 2756 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 29 PID 2756 wrote to memory of 2188 2756 SVCHOST.EXE 30 PID 2756 wrote to memory of 2188 2756 SVCHOST.EXE 30 PID 2756 wrote to memory of 2188 2756 SVCHOST.EXE 30 PID 2756 wrote to memory of 2188 2756 SVCHOST.EXE 30 PID 2756 wrote to memory of 2808 2756 SVCHOST.EXE 31 PID 2756 wrote to memory of 2808 2756 SVCHOST.EXE 31 PID 2756 wrote to memory of 2808 2756 SVCHOST.EXE 31 PID 2756 wrote to memory of 2808 2756 SVCHOST.EXE 31 PID 2808 wrote to memory of 2800 2808 SVCHOST.EXE 32 PID 2808 wrote to memory of 2800 2808 SVCHOST.EXE 32 PID 2808 wrote to memory of 2800 2808 SVCHOST.EXE 32 PID 2808 wrote to memory of 2800 2808 SVCHOST.EXE 32 PID 2808 wrote to memory of 2628 2808 SVCHOST.EXE 33 PID 2808 wrote to memory of 2628 2808 SVCHOST.EXE 33 PID 2808 wrote to memory of 2628 2808 SVCHOST.EXE 33 PID 2808 wrote to memory of 2628 2808 SVCHOST.EXE 33 PID 2808 wrote to memory of 2112 2808 SVCHOST.EXE 34 PID 2808 wrote to memory of 2112 2808 SVCHOST.EXE 34 PID 2808 wrote to memory of 2112 2808 SVCHOST.EXE 34 PID 2808 wrote to memory of 2112 2808 SVCHOST.EXE 34 PID 2112 wrote to memory of 896 2112 SPOOLSV.EXE 35 PID 2112 wrote to memory of 896 2112 SPOOLSV.EXE 35 PID 2112 wrote to memory of 896 2112 SPOOLSV.EXE 35 PID 2112 wrote to memory of 896 2112 SPOOLSV.EXE 35 PID 2112 wrote to memory of 2200 2112 SPOOLSV.EXE 36 PID 2112 wrote to memory of 2200 2112 SPOOLSV.EXE 36 PID 2112 wrote to memory of 2200 2112 SPOOLSV.EXE 36 PID 2112 wrote to memory of 2200 2112 SPOOLSV.EXE 36 PID 2112 wrote to memory of 2372 2112 SPOOLSV.EXE 37 PID 2112 wrote to memory of 2372 2112 SPOOLSV.EXE 37 PID 2112 wrote to memory of 2372 2112 SPOOLSV.EXE 37 PID 2112 wrote to memory of 2372 2112 SPOOLSV.EXE 37 PID 2756 wrote to memory of 316 2756 SVCHOST.EXE 38 PID 2756 wrote to memory of 316 2756 SVCHOST.EXE 38 PID 2756 wrote to memory of 316 2756 SVCHOST.EXE 38 PID 2756 wrote to memory of 316 2756 SVCHOST.EXE 38 PID 2452 wrote to memory of 3036 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 39 PID 2452 wrote to memory of 3036 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 39 PID 2452 wrote to memory of 3036 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 39 PID 2452 wrote to memory of 3036 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 39 PID 2452 wrote to memory of 2916 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 40 PID 2452 wrote to memory of 2916 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 40 PID 2452 wrote to memory of 2916 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 40 PID 2452 wrote to memory of 2916 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 40 PID 2452 wrote to memory of 3056 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 41 PID 2452 wrote to memory of 3056 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 41 PID 2452 wrote to memory of 3056 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 41 PID 2452 wrote to memory of 3056 2452 314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe 41 PID 3056 wrote to memory of 2484 3056 WINWORD.EXE 43 PID 3056 wrote to memory of 2484 3056 WINWORD.EXE 43 PID 3056 wrote to memory of 2484 3056 WINWORD.EXE 43 PID 3056 wrote to memory of 2484 3056 WINWORD.EXE 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe"C:\Users\Admin\AppData\Local\Temp\314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2188
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2800
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2628
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:896
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2200
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2372
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:316
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3036
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2916
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\314e0bce021ff61784829efbc3c5e3fc6d32a948feeb7c78190098fdf26aa685.doc"2⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2484
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
76KB
MD58585301dde5961a212a167d615db605e
SHA1a7bf5176c7a8e159d1ba49c133f9f95831be3328
SHA256e187367d4441939fe374e1e416b3bd65e1b277c4baa53dea2fae67eb7c6f7daa
SHA51257c2d403aef2dcf1e4ac720b3fc7f378ce43fbaa8d46f0260b169f6745ab7fee4003361bace99b3a8303cb83384e07e545b6bc778201294e4ceb2945478830f5
-
Filesize
76KB
MD5852d1b37394b3537379a73352ccd1649
SHA1426582d0b0f49e1366dfb30e6be837fca311c573
SHA25646be060ba6821cf5a2beff25684efb8cd5b36aa7bbcb4ad9cc784919c8e8159f
SHA512998d5f5052b57839618dce354201dbdfffdf8a4aed857e7aee085127e43ec004158ea7a67183e9e51673a5fa16f79fea51af719ce2ac05f8b79eb60927c39222
-
Filesize
76KB
MD592830b2137455befb3a6f349af4cdbda
SHA1a77ba8a09e8345f63a3a113ea1d089a36ba5344c
SHA25608bec05cd64b064f35c05e1acb7838a4c19319923e22b917dc0ed6315b62f008
SHA51274718284da2875035520a80e033998618a3db1198ff63cf8ed1b126479ba7173d594310eb44384cf4c8eacd53448f067eba519a3cdfc15f1fa633c8dd7edf461
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
76KB
MD524f47b8cf27623b8573530fed9189eb9
SHA1423d36c79d22b45d107f7274f62ea288e4187405
SHA256089bb0edfb5cdfa726284763cf1eb452c9ad0b827d99bf0bba29debeec26e877
SHA512ef5f0be638eb2c6a0792acd1f13ba933f3c2f6a08788383c508808d370256882cc571680f5555ff731be3bf3edeb407e1a94f71565af9279726229c1f5b763d0
-
Filesize
76KB
MD59135377787526ee68c5d794a62989afa
SHA130ab291bf619a4065620b30b01c4b1cda2814934
SHA25652a0cb5ac7f1f20a2c0108a92f86397598d1518ff0eadecd12365b217f3312b8
SHA512f70331df0b76fd401e3de6a3df42e7b933c355501cc23877d10dc8b03a1eab7df433c079a5362d73107de8340f4bb77ba73153824ac7cf4e3243443ea01b7f7e
-
Filesize
76KB
MD5f6e15afba59f88a50101a253f7d8355a
SHA16fcbfa06cbe8a0dcf1a87f58222fb1e75470be1d
SHA2561da2548ee3f31d76548b24c79830bd84fc5a50843a0065a1dcbf72c36464c69a
SHA5121d8ba43247c625dc774efc3e1c94b10790f3d60ed748fdb16c3c7eead6e3cc047008bd31e68f11c3aa0f24c706dfaecae6557c06cb4e1377bb663738fe3663f7