Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe
Resource
win7-20240705-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe
-
Size
77KB
-
MD5
fb134b3fe401d18185680cbc63ff4a57
-
SHA1
f9b9c5deb18ff0de87fd8d275299d1f89b0a389c
-
SHA256
e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0
-
SHA512
e55158ff21776f7234b36976c7f9d7823f5699d201b9fa01c8776d531ecaa634a6906d6b6e9c50f0cc0fddc42e6806262d1c23f60e08b3ae5a1deca8181f7e8e
-
SSDEEP
1536:ekeK40T/mx7y9v7Z/Z2V/GSAFRfBhpVoK3:FD40Dmx7y9DZ/Z2hGVkK3
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe -
Executes dropped EXE 12 IoCs
pid Process 2780 SVCHOST.EXE 2784 SVCHOST.EXE 2992 SVCHOST.EXE 2736 SVCHOST.EXE 2660 SVCHOST.EXE 2748 SPOOLSV.EXE 2816 SVCHOST.EXE 2676 SVCHOST.EXE 2512 SPOOLSV.EXE 2588 SPOOLSV.EXE 2940 SVCHOST.EXE 1268 SPOOLSV.EXE -
Loads dropped DLL 21 IoCs
pid Process 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened for modification F:\Recycled\desktop.ini e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\H: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\Y: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\V: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\T: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\W: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\J: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\U: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\K: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\P: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\Q: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\S: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\X: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\G: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\N: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\I: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\O: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\L: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\R: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL\COMMAND e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG\COMMAND e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1632 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2780 SVCHOST.EXE 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2992 SVCHOST.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE 2748 SPOOLSV.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2780 SVCHOST.EXE 2784 SVCHOST.EXE 2992 SVCHOST.EXE 2736 SVCHOST.EXE 2660 SVCHOST.EXE 2748 SPOOLSV.EXE 2816 SVCHOST.EXE 2676 SVCHOST.EXE 2512 SPOOLSV.EXE 2588 SPOOLSV.EXE 2940 SVCHOST.EXE 1268 SPOOLSV.EXE 1632 WINWORD.EXE 1632 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2780 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 30 PID 2204 wrote to memory of 2780 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 30 PID 2204 wrote to memory of 2780 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 30 PID 2204 wrote to memory of 2780 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 30 PID 2780 wrote to memory of 2784 2780 SVCHOST.EXE 31 PID 2780 wrote to memory of 2784 2780 SVCHOST.EXE 31 PID 2780 wrote to memory of 2784 2780 SVCHOST.EXE 31 PID 2780 wrote to memory of 2784 2780 SVCHOST.EXE 31 PID 2780 wrote to memory of 2992 2780 SVCHOST.EXE 32 PID 2780 wrote to memory of 2992 2780 SVCHOST.EXE 32 PID 2780 wrote to memory of 2992 2780 SVCHOST.EXE 32 PID 2780 wrote to memory of 2992 2780 SVCHOST.EXE 32 PID 2992 wrote to memory of 2736 2992 SVCHOST.EXE 33 PID 2992 wrote to memory of 2736 2992 SVCHOST.EXE 33 PID 2992 wrote to memory of 2736 2992 SVCHOST.EXE 33 PID 2992 wrote to memory of 2736 2992 SVCHOST.EXE 33 PID 2992 wrote to memory of 2660 2992 SVCHOST.EXE 34 PID 2992 wrote to memory of 2660 2992 SVCHOST.EXE 34 PID 2992 wrote to memory of 2660 2992 SVCHOST.EXE 34 PID 2992 wrote to memory of 2660 2992 SVCHOST.EXE 34 PID 2992 wrote to memory of 2748 2992 SVCHOST.EXE 35 PID 2992 wrote to memory of 2748 2992 SVCHOST.EXE 35 PID 2992 wrote to memory of 2748 2992 SVCHOST.EXE 35 PID 2992 wrote to memory of 2748 2992 SVCHOST.EXE 35 PID 2748 wrote to memory of 2816 2748 SPOOLSV.EXE 36 PID 2748 wrote to memory of 2816 2748 SPOOLSV.EXE 36 PID 2748 wrote to memory of 2816 2748 SPOOLSV.EXE 36 PID 2748 wrote to memory of 2816 2748 SPOOLSV.EXE 36 PID 2748 wrote to memory of 2676 2748 SPOOLSV.EXE 37 PID 2748 wrote to memory of 2676 2748 SPOOLSV.EXE 37 PID 2748 wrote to memory of 2676 2748 SPOOLSV.EXE 37 PID 2748 wrote to memory of 2676 2748 SPOOLSV.EXE 37 PID 2748 wrote to memory of 2512 2748 SPOOLSV.EXE 38 PID 2748 wrote to memory of 2512 2748 SPOOLSV.EXE 38 PID 2748 wrote to memory of 2512 2748 SPOOLSV.EXE 38 PID 2748 wrote to memory of 2512 2748 SPOOLSV.EXE 38 PID 2780 wrote to memory of 2588 2780 SVCHOST.EXE 39 PID 2780 wrote to memory of 2588 2780 SVCHOST.EXE 39 PID 2780 wrote to memory of 2588 2780 SVCHOST.EXE 39 PID 2780 wrote to memory of 2588 2780 SVCHOST.EXE 39 PID 2204 wrote to memory of 2940 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 41 PID 2204 wrote to memory of 2940 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 41 PID 2204 wrote to memory of 2940 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 41 PID 2204 wrote to memory of 2940 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 41 PID 2780 wrote to memory of 2188 2780 SVCHOST.EXE 40 PID 2780 wrote to memory of 2188 2780 SVCHOST.EXE 40 PID 2780 wrote to memory of 2188 2780 SVCHOST.EXE 40 PID 2780 wrote to memory of 2188 2780 SVCHOST.EXE 40 PID 2204 wrote to memory of 1268 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 42 PID 2204 wrote to memory of 1268 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 42 PID 2204 wrote to memory of 1268 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 42 PID 2204 wrote to memory of 1268 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 42 PID 2204 wrote to memory of 1632 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 43 PID 2204 wrote to memory of 1632 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 43 PID 2204 wrote to memory of 1632 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 43 PID 2204 wrote to memory of 1632 2204 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 43 PID 2188 wrote to memory of 2308 2188 userinit.exe 44 PID 2188 wrote to memory of 2308 2188 userinit.exe 44 PID 2188 wrote to memory of 2308 2188 userinit.exe 44 PID 2188 wrote to memory of 2308 2188 userinit.exe 44 PID 1632 wrote to memory of 1696 1632 WINWORD.EXE 48 PID 1632 wrote to memory of 1696 1632 WINWORD.EXE 48 PID 1632 wrote to memory of 1696 1632 WINWORD.EXE 48 PID 1632 wrote to memory of 1696 1632 WINWORD.EXE 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe"C:\Users\Admin\AppData\Local\Temp\e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2784
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2736
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2660
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2816
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2676
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2512
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵PID:2308
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2940
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1268
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.doc"2⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:1696
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5cb37067dd19860be14438a715794e4f3
SHA1528a5c3bc280611078a30b6c925d681836dfb896
SHA25657200db11ea0d3063e1faf80ee7facf8ab96cbd488a6d33c943b27d45ca56e0c
SHA512b967acf9f874c9083ab37db4f018ba73ab4bc8f6d3e49793a5c35dfae19590943f24bf065f1800e35470ae80457840ceb9fb9087e1244ecf7a3fb199a4a11f87
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
77KB
MD5b5b9693b5b0064b38b9ba5e000c2b4d4
SHA1d222ac5b1b6649dd0e69dace1a000dc883522a28
SHA256b6635142995db85f8b6ab21be0c49efb288975060ddd9708260147d4dd08a78e
SHA51218cc5136d13a00e78f1443644e94811a0fda789ce00ced2b6526a063d73642bafd6b37b3f3da98f4ba13f97aee0172009157346cfc7a807757620ad239c1d680
-
Filesize
77KB
MD5c491a0d41a6c8e300b264ddd610c267b
SHA1e451254aa297ac0dedfdb72d7f41bca5636592eb
SHA2563485b14bbdde4977cee2fa2981b742aabc3c3045fb51b78ea7f4842fd98b1f2e
SHA5125ed53b1dc7534679fe3a75aeb0157b1098d7f3ce11cd847752ee670c20412970021975a37f1c7973a2bf5ce900fe98f1857042e2ba3ae785c6dc600ea054b6e0