Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-09-2024 19:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
120 seconds
Behavioral task
behavioral2
Sample
1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
120 seconds
General
-
Target
1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe
-
Size
45KB
-
MD5
e6a97d00044176bf7454c1cd05012890
-
SHA1
1e00cc418b681951b6aaa497cca458d11102d94e
-
SHA256
1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953
-
SHA512
17a3d1b15f18811af36ac1f46a35013062821a43f0c37b2fe411ae49c2348300047d84badff4e23545bce7c7f7236f23d6584faf0d63490e4d9ae94dc38044f2
-
SSDEEP
768:z1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JXC:zOxyeFo6NPCAosxYyXdF5oy3VoKC
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Executes dropped EXE 12 IoCs
pid Process 3048 SVCHOST.EXE 2148 SVCHOST.EXE 2296 SVCHOST.EXE 2828 SVCHOST.EXE 2772 SVCHOST.EXE 332 SPOOLSV.EXE 2964 SVCHOST.EXE 2732 SVCHOST.EXE 2632 SPOOLSV.EXE 2788 SPOOLSV.EXE 2116 SVCHOST.EXE 972 SPOOLSV.EXE -
Loads dropped DLL 21 IoCs
pid Process 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 3048 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened for modification F:\Recycled\desktop.ini 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\V: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\M: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\W: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\Z: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\N: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\L: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\K: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\J: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\R: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\I: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\Q: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\H: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\O: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\S: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\G: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 28 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG\COMMAND 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL\COMMAND 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1148 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 3048 SVCHOST.EXE 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 2296 SVCHOST.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE 332 SPOOLSV.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 3048 SVCHOST.EXE 2148 SVCHOST.EXE 2296 SVCHOST.EXE 2828 SVCHOST.EXE 2772 SVCHOST.EXE 332 SPOOLSV.EXE 2964 SVCHOST.EXE 2732 SVCHOST.EXE 2632 SPOOLSV.EXE 2788 SPOOLSV.EXE 2116 SVCHOST.EXE 972 SPOOLSV.EXE 1148 WINWORD.EXE 1148 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 3048 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 30 PID 2552 wrote to memory of 3048 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 30 PID 2552 wrote to memory of 3048 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 30 PID 2552 wrote to memory of 3048 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 30 PID 3048 wrote to memory of 2148 3048 SVCHOST.EXE 31 PID 3048 wrote to memory of 2148 3048 SVCHOST.EXE 31 PID 3048 wrote to memory of 2148 3048 SVCHOST.EXE 31 PID 3048 wrote to memory of 2148 3048 SVCHOST.EXE 31 PID 3048 wrote to memory of 2296 3048 SVCHOST.EXE 32 PID 3048 wrote to memory of 2296 3048 SVCHOST.EXE 32 PID 3048 wrote to memory of 2296 3048 SVCHOST.EXE 32 PID 3048 wrote to memory of 2296 3048 SVCHOST.EXE 32 PID 2296 wrote to memory of 2828 2296 SVCHOST.EXE 33 PID 2296 wrote to memory of 2828 2296 SVCHOST.EXE 33 PID 2296 wrote to memory of 2828 2296 SVCHOST.EXE 33 PID 2296 wrote to memory of 2828 2296 SVCHOST.EXE 33 PID 2296 wrote to memory of 2772 2296 SVCHOST.EXE 34 PID 2296 wrote to memory of 2772 2296 SVCHOST.EXE 34 PID 2296 wrote to memory of 2772 2296 SVCHOST.EXE 34 PID 2296 wrote to memory of 2772 2296 SVCHOST.EXE 34 PID 2296 wrote to memory of 332 2296 SVCHOST.EXE 35 PID 2296 wrote to memory of 332 2296 SVCHOST.EXE 35 PID 2296 wrote to memory of 332 2296 SVCHOST.EXE 35 PID 2296 wrote to memory of 332 2296 SVCHOST.EXE 35 PID 332 wrote to memory of 2964 332 SPOOLSV.EXE 36 PID 332 wrote to memory of 2964 332 SPOOLSV.EXE 36 PID 332 wrote to memory of 2964 332 SPOOLSV.EXE 36 PID 332 wrote to memory of 2964 332 SPOOLSV.EXE 36 PID 332 wrote to memory of 2732 332 SPOOLSV.EXE 37 PID 332 wrote to memory of 2732 332 SPOOLSV.EXE 37 PID 332 wrote to memory of 2732 332 SPOOLSV.EXE 37 PID 332 wrote to memory of 2732 332 SPOOLSV.EXE 37 PID 332 wrote to memory of 2632 332 SPOOLSV.EXE 38 PID 332 wrote to memory of 2632 332 SPOOLSV.EXE 38 PID 332 wrote to memory of 2632 332 SPOOLSV.EXE 38 PID 332 wrote to memory of 2632 332 SPOOLSV.EXE 38 PID 3048 wrote to memory of 2788 3048 SVCHOST.EXE 39 PID 3048 wrote to memory of 2788 3048 SVCHOST.EXE 39 PID 3048 wrote to memory of 2788 3048 SVCHOST.EXE 39 PID 3048 wrote to memory of 2788 3048 SVCHOST.EXE 39 PID 2552 wrote to memory of 2116 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 41 PID 2552 wrote to memory of 2116 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 41 PID 2552 wrote to memory of 2116 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 41 PID 2552 wrote to memory of 2116 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 41 PID 3048 wrote to memory of 2180 3048 SVCHOST.EXE 40 PID 3048 wrote to memory of 2180 3048 SVCHOST.EXE 40 PID 3048 wrote to memory of 2180 3048 SVCHOST.EXE 40 PID 3048 wrote to memory of 2180 3048 SVCHOST.EXE 40 PID 2552 wrote to memory of 972 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 42 PID 2552 wrote to memory of 972 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 42 PID 2552 wrote to memory of 972 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 42 PID 2552 wrote to memory of 972 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 42 PID 2180 wrote to memory of 1956 2180 userinit.exe 43 PID 2180 wrote to memory of 1956 2180 userinit.exe 43 PID 2180 wrote to memory of 1956 2180 userinit.exe 43 PID 2180 wrote to memory of 1956 2180 userinit.exe 43 PID 2552 wrote to memory of 1148 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 44 PID 2552 wrote to memory of 1148 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 44 PID 2552 wrote to memory of 1148 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 44 PID 2552 wrote to memory of 1148 2552 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 44 PID 1148 wrote to memory of 984 1148 WINWORD.EXE 48 PID 1148 wrote to memory of 984 1148 WINWORD.EXE 48 PID 1148 wrote to memory of 984 1148 WINWORD.EXE 48 PID 1148 wrote to memory of 984 1148 WINWORD.EXE 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe"C:\Users\Admin\AppData\Local\Temp\1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2148
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2828
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2772
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2964
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2788
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1956
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2116
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:972
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.doc"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:984
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1700
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
45KB
MD5f921796d7c8db7a37981f04b4e408b0f
SHA1fd7b7e36f6131d878e9406d3fb8b956f8c5b1960
SHA25697954a9c4086942d8d339cc690238fad7d283de3a9f4779222280a645171529d
SHA5126bdaac8c77e28adb39220c96bb9fe6f7e8b9fd06ae368f4c9ed051793dfc4b3b3a8fff1cfe261b7a40a695986ef29dcb062d38de4b9d66d732740f9ca25bbb98
-
Filesize
45KB
MD5aad3d5a958a5060603566df937bd3d6e
SHA152a7607a9d9d92b997b60347801a9f94619c5535
SHA25680d88c632dc568822430262f4331fd3ff7cf537d7184e812df9eb1cc2ffa5f35
SHA512a96d2ac73944377cf526543b66a48aac8487b9dafe68e4129c493d237445115d9d7c7e5658d6a4dcb49da202c9dceb9712c368ccf65661092a1996220d98f567
-
Filesize
45KB
MD51b488946dc4a17f84b3b9adf1f3532a2
SHA1581becfc273d83888a0a7e08e67ef69ad7af2d78
SHA25603e92d258b5a62c80ba25f0c82c3d019c760b1138c1517759027bf47601f64a8
SHA51286884fc7f376c7abe0d05b96eb393513233e18fe47970489bc2b044a3659c3e644595137a752a3fd5bab6a2f9883179c4fdb915f83a47b2299ebed868c08ed76