Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 06:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe
Resource
win7-20240705-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe
-
Size
77KB
-
MD5
fb134b3fe401d18185680cbc63ff4a57
-
SHA1
f9b9c5deb18ff0de87fd8d275299d1f89b0a389c
-
SHA256
e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0
-
SHA512
e55158ff21776f7234b36976c7f9d7823f5699d201b9fa01c8776d531ecaa634a6906d6b6e9c50f0cc0fddc42e6806262d1c23f60e08b3ae5a1deca8181f7e8e
-
SSDEEP
1536:ekeK40T/mx7y9v7Z/Z2V/GSAFRfBhpVoK3:FD40Dmx7y9DZ/Z2hGVkK3
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe -
Executes dropped EXE 12 IoCs
pid Process 2660 SVCHOST.EXE 4376 SVCHOST.EXE 100 SVCHOST.EXE 464 SVCHOST.EXE 3888 SVCHOST.EXE 1836 SPOOLSV.EXE 3476 SVCHOST.EXE 3056 SVCHOST.EXE 4024 SPOOLSV.EXE 1908 SPOOLSV.EXE 940 SVCHOST.EXE 4468 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened for modification F:\Recycled\desktop.ini e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\H: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\X: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\P: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\G: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\L: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\R: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\K: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\T: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\Z: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\J: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\S: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\O: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\E: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\I: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\V: e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\InfoTip = "prop:Type;Write;Size" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\QuickTip = "prop:Type;Size" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\TileInfo = "prop:Type;Size" e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000_Classes\Local Settings e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4644 WINWORD.EXE 4644 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 100 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 2660 SVCHOST.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE 1836 SPOOLSV.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 2660 SVCHOST.EXE 4376 SVCHOST.EXE 100 SVCHOST.EXE 464 SVCHOST.EXE 3888 SVCHOST.EXE 1836 SPOOLSV.EXE 3476 SVCHOST.EXE 3056 SVCHOST.EXE 4024 SPOOLSV.EXE 1908 SPOOLSV.EXE 940 SVCHOST.EXE 4468 SPOOLSV.EXE 4644 WINWORD.EXE 4644 WINWORD.EXE 4644 WINWORD.EXE 4644 WINWORD.EXE 4644 WINWORD.EXE 4644 WINWORD.EXE 4644 WINWORD.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3336 wrote to memory of 2660 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 80 PID 3336 wrote to memory of 2660 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 80 PID 3336 wrote to memory of 2660 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 80 PID 2660 wrote to memory of 4376 2660 SVCHOST.EXE 81 PID 2660 wrote to memory of 4376 2660 SVCHOST.EXE 81 PID 2660 wrote to memory of 4376 2660 SVCHOST.EXE 81 PID 2660 wrote to memory of 100 2660 SVCHOST.EXE 82 PID 2660 wrote to memory of 100 2660 SVCHOST.EXE 82 PID 2660 wrote to memory of 100 2660 SVCHOST.EXE 82 PID 100 wrote to memory of 464 100 SVCHOST.EXE 83 PID 100 wrote to memory of 464 100 SVCHOST.EXE 83 PID 100 wrote to memory of 464 100 SVCHOST.EXE 83 PID 100 wrote to memory of 3888 100 SVCHOST.EXE 84 PID 100 wrote to memory of 3888 100 SVCHOST.EXE 84 PID 100 wrote to memory of 3888 100 SVCHOST.EXE 84 PID 100 wrote to memory of 1836 100 SVCHOST.EXE 85 PID 100 wrote to memory of 1836 100 SVCHOST.EXE 85 PID 100 wrote to memory of 1836 100 SVCHOST.EXE 85 PID 1836 wrote to memory of 3476 1836 SPOOLSV.EXE 86 PID 1836 wrote to memory of 3476 1836 SPOOLSV.EXE 86 PID 1836 wrote to memory of 3476 1836 SPOOLSV.EXE 86 PID 1836 wrote to memory of 3056 1836 SPOOLSV.EXE 87 PID 1836 wrote to memory of 3056 1836 SPOOLSV.EXE 87 PID 1836 wrote to memory of 3056 1836 SPOOLSV.EXE 87 PID 1836 wrote to memory of 4024 1836 SPOOLSV.EXE 88 PID 1836 wrote to memory of 4024 1836 SPOOLSV.EXE 88 PID 1836 wrote to memory of 4024 1836 SPOOLSV.EXE 88 PID 2660 wrote to memory of 1908 2660 SVCHOST.EXE 89 PID 2660 wrote to memory of 1908 2660 SVCHOST.EXE 89 PID 2660 wrote to memory of 1908 2660 SVCHOST.EXE 89 PID 3336 wrote to memory of 940 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 90 PID 3336 wrote to memory of 940 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 90 PID 3336 wrote to memory of 940 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 90 PID 2660 wrote to memory of 3532 2660 SVCHOST.EXE 91 PID 2660 wrote to memory of 3532 2660 SVCHOST.EXE 91 PID 2660 wrote to memory of 3532 2660 SVCHOST.EXE 91 PID 3336 wrote to memory of 4468 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 92 PID 3336 wrote to memory of 4468 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 92 PID 3336 wrote to memory of 4468 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 92 PID 3532 wrote to memory of 828 3532 userinit.exe 93 PID 3532 wrote to memory of 828 3532 userinit.exe 93 PID 3532 wrote to memory of 828 3532 userinit.exe 93 PID 3336 wrote to memory of 4644 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 95 PID 3336 wrote to memory of 4644 3336 e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe"C:\Users\Admin\AppData\Local\Temp\e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4376
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:100 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:464
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3888
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3476
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3056
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4024
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵PID:828
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:940
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4468
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e94963b6aaade5d2d4238f763be8a843573dcb1f537522403bb13902576e2fc0.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4644
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5d0fff0b62c64a38bbf82dce6b901837d
SHA1f122b85c0968978ff89089b18635a753f48d3ff8
SHA256eeb7b3c7abe771e261323b8f480fa68eb605a3b002b8482b8da775c2d674b519
SHA512e5db5fc91a90a84f4c684927d5f4e1a8d64f4ac397f1378c2a9661edff3240aca4020a9ee9f4c9dcd0f6fa566dabef3e36e5669982a489e15730121363fc53f0
-
Filesize
77KB
MD535e559947bad683c8f7d8899afa0b31b
SHA16e343a0c8ff8fe8fcc58b52b470b62815c9ff67d
SHA256874b3369d224bbebd25059a396c4b3e41053f7205634602f26de320209e846b1
SHA5123f67992c11e3c190ca5cae510068e23f92ede41d654ac4f039e44a591d3169a51b309c49e64d08a8151803d0f2e82662fd3548871f89fe0d2e8b8e9241625a33
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5ff87babd9c76ccc68ac4e457c803d263
SHA168e829faed8a2b68b07662e80d51e871f92222ce
SHA256a152a61ff54b2d73b2c340073ebd19c86eb4a59930980d2558a0fd845753d2dd
SHA512fda8d61fecafe2b44d4340d05f37e097c55de343e38a7aa91de41fd027c8bbce35458dfa987e2d957bc8c1a53d8c7a4271536c2f1c4e903346ec4e682171cdba
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
77KB
MD5f9662baad2cee47fa07275fc1046ef7e
SHA1ded72666c151063e6b9a62a371c19439c85151d0
SHA2564cbb9d79a556b67a3e37d08a7736faccf7d4e3ca46cc7bae719e3c58b6dd53e6
SHA51239f0821957577b44f33f3c5dd4d46a64fe177176aeb005b336e85cb358fedaa49ecd8e2360944c6fcd2b94d17775cef6af5bd881ffcd61743874815185d6fc87