Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5d0a7eaaee938675bc74adc0bcafae0N.exe
Resource
win7-20240705-en
windows7-x64
15 signatures
120 seconds
Behavioral task
behavioral2
Sample
e5d0a7eaaee938675bc74adc0bcafae0N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
17 signatures
120 seconds
General
-
Target
e5d0a7eaaee938675bc74adc0bcafae0N.exe
-
Size
76KB
-
MD5
e5d0a7eaaee938675bc74adc0bcafae0
-
SHA1
a0dd1554e99f7939752db943e117c6237fcf09a4
-
SHA256
c12043301daed2930a96f8cc2efd121ff661ceb2b047d274995a53cde101f431
-
SHA512
8fda6cf34f628aba81762d56051c41bf1fc5d726100e7a7e30647c86277528f316f1b7488e23caa712096f548ab1a70d787ba03bedcbd9d44bf8259084b058df
-
SSDEEP
1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoIq:T0aXdfXAyy9DZ+N7eB+IIq
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e5d0a7eaaee938675bc74adc0bcafae0N.exe -
Executes dropped EXE 12 IoCs
pid Process 1544 SVCHOST.EXE 1532 SVCHOST.EXE 2380 SVCHOST.EXE 2608 SVCHOST.EXE 2652 SVCHOST.EXE 2780 SPOOLSV.EXE 2508 SVCHOST.EXE 2292 SVCHOST.EXE 2556 SPOOLSV.EXE 2672 SPOOLSV.EXE 1460 SVCHOST.EXE 868 SPOOLSV.EXE -
Loads dropped DLL 20 IoCs
pid Process 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened for modification F:\Recycled\desktop.ini e5d0a7eaaee938675bc74adc0bcafae0N.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\Q: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\M: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\E: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\R: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\I: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\G: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\T: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\O: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\U: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\V: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\Y: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\J: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\H: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\L: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\W: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\Z: e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened (read-only) \??\O: SVCHOST.EXE -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe e5d0a7eaaee938675bc74adc0bcafae0N.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe e5d0a7eaaee938675bc74adc0bcafae0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" e5d0a7eaaee938675bc74adc0bcafae0N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG\COMMAND e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL\COMMAND e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" e5d0a7eaaee938675bc74adc0bcafae0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2200 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 1544 SVCHOST.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2780 SPOOLSV.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 1544 SVCHOST.EXE 1532 SVCHOST.EXE 2380 SVCHOST.EXE 2608 SVCHOST.EXE 2652 SVCHOST.EXE 2780 SPOOLSV.EXE 2508 SVCHOST.EXE 2292 SVCHOST.EXE 2556 SPOOLSV.EXE 2672 SPOOLSV.EXE 1460 SVCHOST.EXE 868 SPOOLSV.EXE 2200 WINWORD.EXE 2200 WINWORD.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1544 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 29 PID 1596 wrote to memory of 1544 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 29 PID 1596 wrote to memory of 1544 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 29 PID 1596 wrote to memory of 1544 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 29 PID 1544 wrote to memory of 1532 1544 SVCHOST.EXE 30 PID 1544 wrote to memory of 1532 1544 SVCHOST.EXE 30 PID 1544 wrote to memory of 1532 1544 SVCHOST.EXE 30 PID 1544 wrote to memory of 1532 1544 SVCHOST.EXE 30 PID 1544 wrote to memory of 2380 1544 SVCHOST.EXE 31 PID 1544 wrote to memory of 2380 1544 SVCHOST.EXE 31 PID 1544 wrote to memory of 2380 1544 SVCHOST.EXE 31 PID 1544 wrote to memory of 2380 1544 SVCHOST.EXE 31 PID 2380 wrote to memory of 2608 2380 SVCHOST.EXE 32 PID 2380 wrote to memory of 2608 2380 SVCHOST.EXE 32 PID 2380 wrote to memory of 2608 2380 SVCHOST.EXE 32 PID 2380 wrote to memory of 2608 2380 SVCHOST.EXE 32 PID 2380 wrote to memory of 2652 2380 SVCHOST.EXE 33 PID 2380 wrote to memory of 2652 2380 SVCHOST.EXE 33 PID 2380 wrote to memory of 2652 2380 SVCHOST.EXE 33 PID 2380 wrote to memory of 2652 2380 SVCHOST.EXE 33 PID 2380 wrote to memory of 2780 2380 SVCHOST.EXE 34 PID 2380 wrote to memory of 2780 2380 SVCHOST.EXE 34 PID 2380 wrote to memory of 2780 2380 SVCHOST.EXE 34 PID 2380 wrote to memory of 2780 2380 SVCHOST.EXE 34 PID 2780 wrote to memory of 2508 2780 SPOOLSV.EXE 35 PID 2780 wrote to memory of 2508 2780 SPOOLSV.EXE 35 PID 2780 wrote to memory of 2508 2780 SPOOLSV.EXE 35 PID 2780 wrote to memory of 2508 2780 SPOOLSV.EXE 35 PID 2780 wrote to memory of 2292 2780 SPOOLSV.EXE 36 PID 2780 wrote to memory of 2292 2780 SPOOLSV.EXE 36 PID 2780 wrote to memory of 2292 2780 SPOOLSV.EXE 36 PID 2780 wrote to memory of 2292 2780 SPOOLSV.EXE 36 PID 2780 wrote to memory of 2556 2780 SPOOLSV.EXE 37 PID 2780 wrote to memory of 2556 2780 SPOOLSV.EXE 37 PID 2780 wrote to memory of 2556 2780 SPOOLSV.EXE 37 PID 2780 wrote to memory of 2556 2780 SPOOLSV.EXE 37 PID 1544 wrote to memory of 2672 1544 SVCHOST.EXE 38 PID 1544 wrote to memory of 2672 1544 SVCHOST.EXE 38 PID 1544 wrote to memory of 2672 1544 SVCHOST.EXE 38 PID 1544 wrote to memory of 2672 1544 SVCHOST.EXE 38 PID 1596 wrote to memory of 1460 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 39 PID 1596 wrote to memory of 1460 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 39 PID 1596 wrote to memory of 1460 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 39 PID 1596 wrote to memory of 1460 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 39 PID 1596 wrote to memory of 868 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 40 PID 1596 wrote to memory of 868 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 40 PID 1596 wrote to memory of 868 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 40 PID 1596 wrote to memory of 868 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 40 PID 1596 wrote to memory of 2200 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 41 PID 1596 wrote to memory of 2200 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 41 PID 1596 wrote to memory of 2200 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 41 PID 1596 wrote to memory of 2200 1596 e5d0a7eaaee938675bc74adc0bcafae0N.exe 41 PID 2200 wrote to memory of 456 2200 WINWORD.EXE 43 PID 2200 wrote to memory of 456 2200 WINWORD.EXE 43 PID 2200 wrote to memory of 456 2200 WINWORD.EXE 43 PID 2200 wrote to memory of 456 2200 WINWORD.EXE 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5d0a7eaaee938675bc74adc0bcafae0N.exe"C:\Users\Admin\AppData\Local\Temp\e5d0a7eaaee938675bc74adc0bcafae0N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2652
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2508
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2292
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2556
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2672
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1460
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:868
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e5d0a7eaaee938675bc74adc0bcafae0N.doc"2⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:456
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
76KB
MD5952904ede203c04fff70772572e4d747
SHA176921ab23322c4a099871edc13639c996cc45b18
SHA256c39d5e898f318711ceb63063d859f4d6ea4df75af1dd6021b7705d87b3e0e043
SHA512f1831dae3667df2655a817429a75f05b3c8d0a2cbf2adb38d546a9d79760591ccfbb8f7298ab4b1b86ebaf762a5e206e673c2639363a8cdefd27af505c389ae2
-
Filesize
76KB
MD521f0d09f44fccf424fa3eeba0605325a
SHA122cd72c0945ead5feef81c63f8132e477cb30eab
SHA2561d39f1905fedc8b5732a70706f503f7017d027a07d6e1e9008670047fb6ea879
SHA512a37727a8a3eb107fa23d07ce9d2bab90c7ead7a523e1b4c9782598d85694529597ede35192584205e3317e31102b6f0f4a98e307141cd7ec745c1c55833ad516
-
Filesize
76KB
MD5ed1b12f8f01f0d1a8b634ffc7610d87e
SHA111ac61e06cfd4f3dbf213dbc9f6360038dada91c
SHA2562c8b50bf76d24bef9f4c115c5d5594d023951092b6c459c3ca92b326a8c43870
SHA512d1021d07b6c00ccde85b4c13c1ede0428fe9d99c9e95146f29764002de1a14bfde69a5d5d1c97ce44d935370af3801511b39cc82f56d72b5e90008d76a557c07
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
76KB
MD561c4e102d93e799614a743e2fbca0861
SHA1bf952010e19795cbd517c97397a06c6c0b443493
SHA25604bffa635cc603a3882314e2f9f809408ff82d7c34286f239431b55c62fce898
SHA5121bf54235ce005b08115f8e17b07de61466d7c55f2b7989951431cbdcc40784434b6ace51acb3ce8ae3ff0a849b2f21c95f93c091d14f6d84a15e65e94376f895
-
Filesize
76KB
MD55d636d0238d0303795ea1323da0362f1
SHA17f1710a508b1ee0b0619fe3208fd8a8176464f68
SHA25615b244b105aa7699507e13da567dc7fc3f5c711a0e2011d9accc1988279e4b15
SHA512df3fb2e6003f280364d7bb5fa3121851b522eb5fa44d43a70b211ba97d409aaf6b2babfecb7868cd89ed5644936762ed00010261d1e8cd786c81c8d59a7fa49c
-
Filesize
76KB
MD5f8c2975b0fc9863c383d394989b44017
SHA1c1351a66efead34c5b6dd30a16d92a4e73e995a3
SHA2560adb81be9818ef84795a407924e2ee7cde6c0af754fed0a315925ed8c2561796
SHA512d9354fb858fb47c53aed220d87f3bd30ddfca25545fe6972e3f38c5f0f943f560babef55dc0574571dcfd380314bb08740dde77efe2dfaf690b06d4bc902081a