Analysis
-
max time kernel
119s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 19:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
120 seconds
Behavioral task
behavioral2
Sample
1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
120 seconds
General
-
Target
1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe
-
Size
45KB
-
MD5
e6a97d00044176bf7454c1cd05012890
-
SHA1
1e00cc418b681951b6aaa497cca458d11102d94e
-
SHA256
1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953
-
SHA512
17a3d1b15f18811af36ac1f46a35013062821a43f0c37b2fe411ae49c2348300047d84badff4e23545bce7c7f7236f23d6584faf0d63490e4d9ae94dc38044f2
-
SSDEEP
768:z1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JXC:zOxyeFo6NPCAosxYyXdF5oy3VoKC
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Executes dropped EXE 12 IoCs
pid Process 2536 SVCHOST.EXE 1496 SVCHOST.EXE 5040 SVCHOST.EXE 4944 SVCHOST.EXE 3112 SVCHOST.EXE 8 SPOOLSV.EXE 4224 SVCHOST.EXE 3016 SVCHOST.EXE 3088 SPOOLSV.EXE 4048 SPOOLSV.EXE 1620 SVCHOST.EXE 2032 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened for modification F:\Recycled\desktop.ini 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\S: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\W: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\X: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\E: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\N: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\Z: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\L: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\G: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\V: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\K: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\Q: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\R: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\H: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\P: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\I: 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\TileInfo = "prop:Type;Size" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\QuickTip = "prop:Type;Size" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4648 WINWORD.EXE 4648 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 8 SPOOLSV.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 5040 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 2536 SVCHOST.EXE 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 2536 SVCHOST.EXE 1496 SVCHOST.EXE 5040 SVCHOST.EXE 4944 SVCHOST.EXE 3112 SVCHOST.EXE 8 SPOOLSV.EXE 4224 SVCHOST.EXE 3016 SVCHOST.EXE 3088 SPOOLSV.EXE 4048 SPOOLSV.EXE 1620 SVCHOST.EXE 2032 SPOOLSV.EXE 4648 WINWORD.EXE 4648 WINWORD.EXE 4648 WINWORD.EXE 4648 WINWORD.EXE 4648 WINWORD.EXE 4648 WINWORD.EXE 4648 WINWORD.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4576 wrote to memory of 2536 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 84 PID 4576 wrote to memory of 2536 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 84 PID 4576 wrote to memory of 2536 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 84 PID 2536 wrote to memory of 1496 2536 SVCHOST.EXE 85 PID 2536 wrote to memory of 1496 2536 SVCHOST.EXE 85 PID 2536 wrote to memory of 1496 2536 SVCHOST.EXE 85 PID 2536 wrote to memory of 5040 2536 SVCHOST.EXE 86 PID 2536 wrote to memory of 5040 2536 SVCHOST.EXE 86 PID 2536 wrote to memory of 5040 2536 SVCHOST.EXE 86 PID 5040 wrote to memory of 4944 5040 SVCHOST.EXE 87 PID 5040 wrote to memory of 4944 5040 SVCHOST.EXE 87 PID 5040 wrote to memory of 4944 5040 SVCHOST.EXE 87 PID 5040 wrote to memory of 3112 5040 SVCHOST.EXE 88 PID 5040 wrote to memory of 3112 5040 SVCHOST.EXE 88 PID 5040 wrote to memory of 3112 5040 SVCHOST.EXE 88 PID 5040 wrote to memory of 8 5040 SVCHOST.EXE 89 PID 5040 wrote to memory of 8 5040 SVCHOST.EXE 89 PID 5040 wrote to memory of 8 5040 SVCHOST.EXE 89 PID 8 wrote to memory of 4224 8 SPOOLSV.EXE 90 PID 8 wrote to memory of 4224 8 SPOOLSV.EXE 90 PID 8 wrote to memory of 4224 8 SPOOLSV.EXE 90 PID 8 wrote to memory of 3016 8 SPOOLSV.EXE 91 PID 8 wrote to memory of 3016 8 SPOOLSV.EXE 91 PID 8 wrote to memory of 3016 8 SPOOLSV.EXE 91 PID 8 wrote to memory of 3088 8 SPOOLSV.EXE 92 PID 8 wrote to memory of 3088 8 SPOOLSV.EXE 92 PID 8 wrote to memory of 3088 8 SPOOLSV.EXE 92 PID 2536 wrote to memory of 4048 2536 SVCHOST.EXE 93 PID 2536 wrote to memory of 4048 2536 SVCHOST.EXE 93 PID 2536 wrote to memory of 4048 2536 SVCHOST.EXE 93 PID 4576 wrote to memory of 1620 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 94 PID 4576 wrote to memory of 1620 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 94 PID 4576 wrote to memory of 1620 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 94 PID 4576 wrote to memory of 2032 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 95 PID 4576 wrote to memory of 2032 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 95 PID 4576 wrote to memory of 2032 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 95 PID 2536 wrote to memory of 1144 2536 SVCHOST.EXE 96 PID 2536 wrote to memory of 1144 2536 SVCHOST.EXE 96 PID 2536 wrote to memory of 1144 2536 SVCHOST.EXE 96 PID 1144 wrote to memory of 1168 1144 userinit.exe 97 PID 1144 wrote to memory of 1168 1144 userinit.exe 97 PID 1144 wrote to memory of 1168 1144 userinit.exe 97 PID 4576 wrote to memory of 4648 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 99 PID 4576 wrote to memory of 4648 4576 1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe"C:\Users\Admin\AppData\Local\Temp\1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1496
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4944
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3112
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:8 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4224
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3016
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3088
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4048
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1168
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1620
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2032
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1e7c0d0add11107cda939242c1403eedd5a96492fad83b9b481a1a0862c39953N.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4648
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5c77b75f2c1e6907f876179fccf96d427
SHA121c0f6360ea20cec5cd81aece23a503abe52238e
SHA256ad5ae550f300eead54fc675b75bef1afcab9104f5f4d8e44743accbd16ca9d43
SHA5121e37271b2cd878bebf6ba3265a39ec3a659ed8beee55e7d1951f0dc3f1a1968e4830b3482591bd3a6e0bff73fefb94452e28bb37b240e77d3b83f06c58c357fb
-
Filesize
45KB
MD5ad11ea67616b2adc0ddba569cec7c49b
SHA1d615f4ed082cde11f64f465ce4aeaffa127267de
SHA256ce881d0460a6e7134f0f3913ef4d0e8a2b505c8d1132120b8c50bef5ea7c5e29
SHA512129a071bcca4038d24e3350d06c1cfe8279bf006153744cdea809991354fd666ffec45866858a2e43b1fd9a4603d2b408c12480da0cd86690ee07d58192151ec
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
45KB
MD5e3d54d8a933a24b5621896ea6a14b1bb
SHA199ed5b67507608222411bae2ace7fd25f18d2150
SHA256c54bba9e043b7393c5f32ddebbeca7bdf7d653d43f04a96828349bad36aeae8f
SHA51234e987185aeaba0c5e97c255e80b55f7732d46c90316bfd53bdc2999d919098024d99df593bd5606891566b9905d23cbab5801881e27a6c74364a5d4a171d0a2