Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 04:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe
Resource
win7-20240704-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe
Resource
win10v2004-20240730-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe
-
Size
76KB
-
MD5
ed2bc548b81b2b21dd3a9be25fecd67d
-
SHA1
11bb4216d570a40f58967e0ffcb2af83b3095e65
-
SHA256
b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9
-
SHA512
0b77bf9542d77724f4c504b1676a4b75d47972ace5122d9266ef934597c4c4efbefc6a92611169e97a3e80a6d62d11cbe8abca91310d2b424f8d2ecdc856734c
-
SSDEEP
1536:v70ak+ddygXAyy9v7Z+NoykJHBOAFRfBjG3ldoID:T0aXdfXAyy9DZ+N7eB+IID
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000\Control Panel\International\Geo\Nation b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe -
Executes dropped EXE 12 IoCs
pid Process 4252 SVCHOST.EXE 2728 SVCHOST.EXE 1096 SVCHOST.EXE 3308 SVCHOST.EXE 4964 SVCHOST.EXE 1244 SPOOLSV.EXE 4648 SVCHOST.EXE 2556 SVCHOST.EXE 3208 SPOOLSV.EXE 5048 SPOOLSV.EXE 1176 SVCHOST.EXE 112 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened for modification F:\Recycled\desktop.ini b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\N: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\W: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\Y: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\H: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\M: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Q: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\X: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\J: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\O: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\E: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\K: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\G: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\S: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\P: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\L: b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\N: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\QuickTip = "prop:Type;Size" b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\InfoTip = "prop:Type;Write;Size" b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\TileInfo = "prop:Type;Size" b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Key created \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\Local Settings b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-807826884-2440573969-3755798217-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3412 WINWORD.EXE 3412 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4252 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 1244 SPOOLSV.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE 4252 SVCHOST.EXE 4252 SVCHOST.EXE 1096 SVCHOST.EXE 1096 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 4252 SVCHOST.EXE 2728 SVCHOST.EXE 1096 SVCHOST.EXE 3308 SVCHOST.EXE 4964 SVCHOST.EXE 1244 SPOOLSV.EXE 4648 SVCHOST.EXE 2556 SVCHOST.EXE 3208 SPOOLSV.EXE 5048 SPOOLSV.EXE 1176 SVCHOST.EXE 112 SPOOLSV.EXE 3412 WINWORD.EXE 3412 WINWORD.EXE 3412 WINWORD.EXE 3412 WINWORD.EXE 3412 WINWORD.EXE 3412 WINWORD.EXE 3412 WINWORD.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1080 wrote to memory of 4252 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 86 PID 1080 wrote to memory of 4252 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 86 PID 1080 wrote to memory of 4252 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 86 PID 4252 wrote to memory of 2728 4252 SVCHOST.EXE 87 PID 4252 wrote to memory of 2728 4252 SVCHOST.EXE 87 PID 4252 wrote to memory of 2728 4252 SVCHOST.EXE 87 PID 4252 wrote to memory of 1096 4252 SVCHOST.EXE 88 PID 4252 wrote to memory of 1096 4252 SVCHOST.EXE 88 PID 4252 wrote to memory of 1096 4252 SVCHOST.EXE 88 PID 1096 wrote to memory of 3308 1096 SVCHOST.EXE 89 PID 1096 wrote to memory of 3308 1096 SVCHOST.EXE 89 PID 1096 wrote to memory of 3308 1096 SVCHOST.EXE 89 PID 1096 wrote to memory of 4964 1096 SVCHOST.EXE 90 PID 1096 wrote to memory of 4964 1096 SVCHOST.EXE 90 PID 1096 wrote to memory of 4964 1096 SVCHOST.EXE 90 PID 1096 wrote to memory of 1244 1096 SVCHOST.EXE 91 PID 1096 wrote to memory of 1244 1096 SVCHOST.EXE 91 PID 1096 wrote to memory of 1244 1096 SVCHOST.EXE 91 PID 1244 wrote to memory of 4648 1244 SPOOLSV.EXE 92 PID 1244 wrote to memory of 4648 1244 SPOOLSV.EXE 92 PID 1244 wrote to memory of 4648 1244 SPOOLSV.EXE 92 PID 1244 wrote to memory of 2556 1244 SPOOLSV.EXE 93 PID 1244 wrote to memory of 2556 1244 SPOOLSV.EXE 93 PID 1244 wrote to memory of 2556 1244 SPOOLSV.EXE 93 PID 1244 wrote to memory of 3208 1244 SPOOLSV.EXE 94 PID 1244 wrote to memory of 3208 1244 SPOOLSV.EXE 94 PID 1244 wrote to memory of 3208 1244 SPOOLSV.EXE 94 PID 4252 wrote to memory of 5048 4252 SVCHOST.EXE 95 PID 4252 wrote to memory of 5048 4252 SVCHOST.EXE 95 PID 4252 wrote to memory of 5048 4252 SVCHOST.EXE 95 PID 1080 wrote to memory of 1176 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 96 PID 1080 wrote to memory of 1176 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 96 PID 1080 wrote to memory of 1176 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 96 PID 1080 wrote to memory of 112 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 97 PID 1080 wrote to memory of 112 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 97 PID 1080 wrote to memory of 112 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 97 PID 1080 wrote to memory of 3412 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 98 PID 1080 wrote to memory of 3412 1080 b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe"C:\Users\Admin\AppData\Local\Temp\b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3308
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4964
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4648
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2556
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3208
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5048
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:112
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b90f3d8d11cee6ae47b5fad00488c840f687eeb7c33d69f8fb93508bb5b3cec9.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD544a65adef1da82eb4c269d632c061fdd
SHA1d06e5fb73ecc01e503c5cdbb934bf60c28b6e18d
SHA256eebdaed8292e763ce7517dc893c26b92b07e536f6e8bd93f78ce6d77f11e722e
SHA512af1d938421440bbdd16020a4145da9394cbcd93531ce3bf1f39217beee7a6990b540a09e3ce0de426119d17d0792b090d4446e55c59a9558c0ca6dc6a39606f5
-
Filesize
76KB
MD53b702e7f9200af7cff5fef35dc0ffd40
SHA1c0acee89dfb85abfef860903f9df7a898906712c
SHA256cef564f81e1ffeb1e6323ec832d831ca015e4b88955d3b96231b146adf898e97
SHA512d15a90767d8e3dd942c32302445e59067f7d1785dc8023a927566f742fb34f18c9162617d4c72bb89a56686d8abb44b063c0ff387db2feecb89e4f0df67de69d
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD56673a8357096e215b00cbed987cdf575
SHA174b9f4edf525ec923b3052f2d162ea898f8d036d
SHA25664d963f390223bdc319bcbfa27452bae8a3632df3c687ed941434e3a4eeda56f
SHA512f4fa142b6ca96b5537d30f45e1eb92ca391930722e12bf32a44ffe0863bc47989384c16a5c7161d0127eb0294acbdecf2b2b8252bbd3eadea365e66c6bc8718d
-
Filesize
76KB
MD53df1a6af24f6abda90da6a6b126f6554
SHA1f53f4bd828449a38d44837c132b13d1aafcfa8e5
SHA256affaad5b2501767d4adc06d5bcedf7d09d6780d51d541cd9af54d3491aedd80b
SHA512452f029720212a8953ed29d9fe6bc155c7fcf9411f9e0e15805d3f8da3765dec59639803836be1199d61b53a80c0b99afcfb9bc8fbdf1014fd5ed3915a67f9e8
-
Filesize
76KB
MD50a7b88efc6ddda93d33857d5ce60fc61
SHA1ca6cdacff535dde17450b675d211312ae30b0d56
SHA25692594ec2a8bcb9aa89d497460f4bb79731a18951215247c88d7f3ec5d9bc6230
SHA51272697ffd9445915e081416243fa0a0cf0df8cf4d890bb29d151cf7a8c62be0b7c28a3f055eefa3a64dc56b14c1e3d9c6dd10a65c8ee63b464f94f414fa2292a2
-
Filesize
76KB
MD5c96b57be0f49c0ae6d09a2be764cac32
SHA12fc701bc8aa64cda6fd00c0f285b0eb283689211
SHA256a62d65e7ff61e161cd5a0a0e7ae4c718124eabc1c10c12083c31568596075b1f
SHA512fd10382ea179a14f7cecf1f2a0c7e267ba9f3321c119c7ebb03e69425f65b4273434d1a189adf7488e418496627b18aa075b9dfa62d110d40a4a8e7065cf0817
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
76KB
MD5dd33f8f28b87a90ceb355160e2d243b6
SHA1e796a4431f7f42352c252d36de89013fd4ac1f29
SHA25665fd5ebe0a3b222d67e7769ba04e27c074148fc58fd7e6c626729ff421dcdea6
SHA512c5208fa4d86ae593049ee44826df88bb873ecff0c8c7e5994c37182e7a00e88105c85a4f606fce58bcc334d139e40bf740ffaf859e22c81923ee8898131e22cf