Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2024, 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16e5d77011e767f42c46d1278ad83ce0N.exe
Resource
win7-20240705-en
windows7-x64
16 signatures
120 seconds
Behavioral task
behavioral2
Sample
16e5d77011e767f42c46d1278ad83ce0N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
120 seconds
General
-
Target
16e5d77011e767f42c46d1278ad83ce0N.exe
-
Size
87KB
-
MD5
16e5d77011e767f42c46d1278ad83ce0
-
SHA1
2207eb4ba1d933941f7176fbfcd0136912dd4756
-
SHA256
e5726a2dac6befbca69345e5413d93464ec8f52162d045e195327d49b41a6192
-
SHA512
0be937a66f08c05f6218100d172a34d92d86e4910adffca216581ea6c545a4683ff474397e5af55a967703f1f875166e92ff5fbc64e6fb11ccd801a263a558a2
-
SSDEEP
1536:1a3+ddygX7y9v7Z+NoykJHBOAFRfBjG3ldoI2:08dfX7y9DZ+N7eB+II2
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 16e5d77011e767f42c46d1278ad83ce0N.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 16e5d77011e767f42c46d1278ad83ce0N.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 16e5d77011e767f42c46d1278ad83ce0N.exe -
Executes dropped EXE 12 IoCs
pid Process 1584 SVCHOST.EXE 2488 SVCHOST.EXE 676 SVCHOST.EXE 1168 SVCHOST.EXE 4504 SVCHOST.EXE 1960 SPOOLSV.EXE 2832 SVCHOST.EXE 3876 SVCHOST.EXE 4832 SPOOLSV.EXE 1596 SPOOLSV.EXE 232 SVCHOST.EXE 4420 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 16e5d77011e767f42c46d1278ad83ce0N.exe File opened for modification F:\Recycled\desktop.ini 16e5d77011e767f42c46d1278ad83ce0N.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\K: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\V: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\W: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\J: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\P: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\G: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\L: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\N: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\S: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\E: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\O: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\U: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\Y: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\M: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\T: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\X: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\H: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\Q: 16e5d77011e767f42c46d1278ad83ce0N.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\R: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 16e5d77011e767f42c46d1278ad83ce0N.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe 16e5d77011e767f42c46d1278ad83ce0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16e5d77011e767f42c46d1278ad83ce0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\TileInfo = "prop:Type;Size" 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 16e5d77011e767f42c46d1278ad83ce0N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 16e5d77011e767f42c46d1278ad83ce0N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\QuickTip = "prop:Type;Size" 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 16e5d77011e767f42c46d1278ad83ce0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2748 WINWORD.EXE 2748 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1960 SPOOLSV.EXE 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 676 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE 1584 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 1584 SVCHOST.EXE 2488 SVCHOST.EXE 676 SVCHOST.EXE 1168 SVCHOST.EXE 4504 SVCHOST.EXE 1960 SPOOLSV.EXE 2832 SVCHOST.EXE 3876 SVCHOST.EXE 4832 SPOOLSV.EXE 1596 SPOOLSV.EXE 232 SVCHOST.EXE 4420 SPOOLSV.EXE 2748 WINWORD.EXE 2748 WINWORD.EXE 2748 WINWORD.EXE 2748 WINWORD.EXE 2748 WINWORD.EXE 2748 WINWORD.EXE 2748 WINWORD.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1988 wrote to memory of 1584 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 92 PID 1988 wrote to memory of 1584 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 92 PID 1988 wrote to memory of 1584 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 92 PID 1584 wrote to memory of 2488 1584 SVCHOST.EXE 93 PID 1584 wrote to memory of 2488 1584 SVCHOST.EXE 93 PID 1584 wrote to memory of 2488 1584 SVCHOST.EXE 93 PID 1584 wrote to memory of 676 1584 SVCHOST.EXE 95 PID 1584 wrote to memory of 676 1584 SVCHOST.EXE 95 PID 1584 wrote to memory of 676 1584 SVCHOST.EXE 95 PID 676 wrote to memory of 1168 676 SVCHOST.EXE 96 PID 676 wrote to memory of 1168 676 SVCHOST.EXE 96 PID 676 wrote to memory of 1168 676 SVCHOST.EXE 96 PID 676 wrote to memory of 4504 676 SVCHOST.EXE 97 PID 676 wrote to memory of 4504 676 SVCHOST.EXE 97 PID 676 wrote to memory of 4504 676 SVCHOST.EXE 97 PID 676 wrote to memory of 1960 676 SVCHOST.EXE 98 PID 676 wrote to memory of 1960 676 SVCHOST.EXE 98 PID 676 wrote to memory of 1960 676 SVCHOST.EXE 98 PID 1960 wrote to memory of 2832 1960 SPOOLSV.EXE 100 PID 1960 wrote to memory of 2832 1960 SPOOLSV.EXE 100 PID 1960 wrote to memory of 2832 1960 SPOOLSV.EXE 100 PID 1960 wrote to memory of 3876 1960 SPOOLSV.EXE 101 PID 1960 wrote to memory of 3876 1960 SPOOLSV.EXE 101 PID 1960 wrote to memory of 3876 1960 SPOOLSV.EXE 101 PID 1960 wrote to memory of 4832 1960 SPOOLSV.EXE 102 PID 1960 wrote to memory of 4832 1960 SPOOLSV.EXE 102 PID 1960 wrote to memory of 4832 1960 SPOOLSV.EXE 102 PID 1584 wrote to memory of 1596 1584 SVCHOST.EXE 103 PID 1584 wrote to memory of 1596 1584 SVCHOST.EXE 103 PID 1584 wrote to memory of 1596 1584 SVCHOST.EXE 103 PID 1988 wrote to memory of 232 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 104 PID 1988 wrote to memory of 232 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 104 PID 1988 wrote to memory of 232 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 104 PID 1988 wrote to memory of 4420 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 105 PID 1988 wrote to memory of 4420 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 105 PID 1988 wrote to memory of 4420 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 105 PID 1988 wrote to memory of 2748 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 107 PID 1988 wrote to memory of 2748 1988 16e5d77011e767f42c46d1278ad83ce0N.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\16e5d77011e767f42c46d1278ad83ce0N.exe"C:\Users\Admin\AppData\Local\Temp\16e5d77011e767f42c46d1278ad83ce0N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2488
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1168
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4504
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2832
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3876
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4832
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:232
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4420
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\16e5d77011e767f42c46d1278ad83ce0N.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4128,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:81⤵PID:2456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5bf71d5eca5ba3e688028561c7ad29163
SHA1c5c52ece08b938f6a96601b48420476a3a61d42a
SHA25659ed763b5922bfacdb355f0003d927230e6f1e8ffee948a25c47a8910af513f4
SHA512963e9fd1011e48a7b1b2d4c7946ccfd8dd6d150eab191fcc35995af5508850a77f9db328455351bba59235d50fcafbce8fd7864cff42604045e35ec38a57206d
-
Filesize
87KB
MD569d4285b64a6ba27eb49aa1008ca1290
SHA163315d4b5211974f406916e0562499e1e257c618
SHA2561588bcceeab15df4a87659d74f6ed44eaf253d8c9b1d8a8678ca9feb75b663b7
SHA512ed3a5acc0178821962f8a1d4e22d7b090d4be3e79da13e2e2edf2a5ce3e07af6ccefc7ad1d49c9baba215aa28d06fdb19acb37dd1f7994993a434182c84ce61b
-
Filesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD56564c2541904a41ca3f3733ee3f3234f
SHA1768632b28e33d44a2797cd7515b7b7529c0b40c8
SHA256dfeb626e39710d773650e2c2a657d04c21d92c2c8ef16d65b7920770bfd7a586
SHA512def9bd155fd89f8e6ddc756c762da019cfa94b0d52148c6d39ef8d08936d6a43eb79fa56c2c9288cf5f697b1b76c61f4cd0fa56105080edc5be4530574f682eb
-
Filesize
87KB
MD5c8896e79f72ad59a322b71c125932af0
SHA1878344f75d700d97cd63544c73f0dcf49af3fec5
SHA2562c641cb7a84d6e12334ba162a236038aba972aeb35cfc67aa510935ed61ce0a5
SHA512b5021a717521578b478510c4460d022c1906e110971e443794661134fae478511630f64cd363a690356f502156c2197361c526ee989437b6dd530b95b834467a
-
Filesize
87KB
MD59c5a89a4018c208725d966e135266525
SHA196d8aa3832e67b61656f8487b106646512e99374
SHA25671892a67166b4cb80fa59f448ab34a892fcc6e579b7be21634bd8af02517845b
SHA51213961d98836cbe6fae0ef171b683d1f9aa20eec4cb8d2405210cd58103da8c7bccf17c2078ea4c15d49c4b7323e1e820d7f98ccb49b706888b8147b45fc45448
-
Filesize
87KB
MD554f97dfc9f6281ce1bae6a61b45872fa
SHA1ba086995adda8f42ee0ffcd636e6adaeedadc8dd
SHA25698f38ad2d5a88f923bcc798d0e6a1fd630e8cf19739140a385839a68f5d8e41f
SHA512f50659b7ebf179dae029a3d13f186f52bc70d2e0e3c75fc6e13c72ebd1f2f018dad0a1f4ff6cc599ec556131a99d870aed5d1e4161559867d8fe719cb575ed36
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
87KB
MD5757b123d2a48fa38ea6c308d4d80ee32
SHA1cb6f0786d7b19fd85fde449c8e211e341521b1aa
SHA25640f2204d421650e7628d9ca46aadb1f197bf74fa4293369f598baaa8673fdc93
SHA5121220806e1a11f1cc040a33698a7b432db09e910c8a7ca7393cf00c8887f801c5d88bd8992e2b2b7f82932f2c5d52ab8fb6a8e7e208675bc3d957ac492ab8cc4b