Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 01:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
120 seconds
Behavioral task
behavioral2
Sample
87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
17 signatures
120 seconds
General
-
Target
87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe
-
Size
45KB
-
MD5
06102d862a4a1aad9e0cc4972065a3b0
-
SHA1
9197edb6b32290f31276b39a2af162efa7a65327
-
SHA256
87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793
-
SHA512
280ee6f811c8d2e9b153f17874fe56d18b4760fb20edcefffd04ae2428b35947205ecf890de64f59eb0f1f11fe488dee4f36dc7a7e31cc7071e72422e386ae23
-
SSDEEP
768:5qt/WXwCXV/aNOFi5XOCmg9TgEqxZihrWS9ybsvw+I9D88888888888JXl:5UWXaMU5Xvp3FrbCEnl
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe -
Executes dropped EXE 12 IoCs
pid Process 2792 SVCHOST.EXE 2800 SVCHOST.EXE 2944 SVCHOST.EXE 2720 SVCHOST.EXE 2636 SVCHOST.EXE 2892 SPOOLSV.EXE 2604 SVCHOST.EXE 2676 SVCHOST.EXE 3060 SPOOLSV.EXE 1840 SPOOLSV.EXE 856 SVCHOST.EXE 2472 SPOOLSV.EXE -
Loads dropped DLL 21 IoCs
pid Process 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened for modification F:\Recycled\desktop.ini 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\J: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\V: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\Z: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\G: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\Q: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\T: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\I: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\Y: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\M: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\P: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\L: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\X: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\N: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\H: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\U: 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\O: SPOOLSV.EXE -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 28 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL\COMMAND 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG\COMMAND 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\INSTALL 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1240 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2792 SVCHOST.EXE 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2944 SVCHOST.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE 2892 SPOOLSV.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 2792 SVCHOST.EXE 2800 SVCHOST.EXE 2944 SVCHOST.EXE 2720 SVCHOST.EXE 2636 SVCHOST.EXE 2892 SPOOLSV.EXE 2604 SVCHOST.EXE 2676 SVCHOST.EXE 3060 SPOOLSV.EXE 1840 SPOOLSV.EXE 856 SVCHOST.EXE 2472 SPOOLSV.EXE 1240 WINWORD.EXE 1240 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2792 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 30 PID 2504 wrote to memory of 2792 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 30 PID 2504 wrote to memory of 2792 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 30 PID 2504 wrote to memory of 2792 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 30 PID 2792 wrote to memory of 2800 2792 SVCHOST.EXE 31 PID 2792 wrote to memory of 2800 2792 SVCHOST.EXE 31 PID 2792 wrote to memory of 2800 2792 SVCHOST.EXE 31 PID 2792 wrote to memory of 2800 2792 SVCHOST.EXE 31 PID 2792 wrote to memory of 2944 2792 SVCHOST.EXE 32 PID 2792 wrote to memory of 2944 2792 SVCHOST.EXE 32 PID 2792 wrote to memory of 2944 2792 SVCHOST.EXE 32 PID 2792 wrote to memory of 2944 2792 SVCHOST.EXE 32 PID 2944 wrote to memory of 2720 2944 SVCHOST.EXE 33 PID 2944 wrote to memory of 2720 2944 SVCHOST.EXE 33 PID 2944 wrote to memory of 2720 2944 SVCHOST.EXE 33 PID 2944 wrote to memory of 2720 2944 SVCHOST.EXE 33 PID 2944 wrote to memory of 2636 2944 SVCHOST.EXE 34 PID 2944 wrote to memory of 2636 2944 SVCHOST.EXE 34 PID 2944 wrote to memory of 2636 2944 SVCHOST.EXE 34 PID 2944 wrote to memory of 2636 2944 SVCHOST.EXE 34 PID 2944 wrote to memory of 2892 2944 SVCHOST.EXE 35 PID 2944 wrote to memory of 2892 2944 SVCHOST.EXE 35 PID 2944 wrote to memory of 2892 2944 SVCHOST.EXE 35 PID 2944 wrote to memory of 2892 2944 SVCHOST.EXE 35 PID 2892 wrote to memory of 2604 2892 SPOOLSV.EXE 36 PID 2892 wrote to memory of 2604 2892 SPOOLSV.EXE 36 PID 2892 wrote to memory of 2604 2892 SPOOLSV.EXE 36 PID 2892 wrote to memory of 2604 2892 SPOOLSV.EXE 36 PID 2892 wrote to memory of 2676 2892 SPOOLSV.EXE 37 PID 2892 wrote to memory of 2676 2892 SPOOLSV.EXE 37 PID 2892 wrote to memory of 2676 2892 SPOOLSV.EXE 37 PID 2892 wrote to memory of 2676 2892 SPOOLSV.EXE 37 PID 2892 wrote to memory of 3060 2892 SPOOLSV.EXE 38 PID 2892 wrote to memory of 3060 2892 SPOOLSV.EXE 38 PID 2892 wrote to memory of 3060 2892 SPOOLSV.EXE 38 PID 2892 wrote to memory of 3060 2892 SPOOLSV.EXE 38 PID 2792 wrote to memory of 1840 2792 SVCHOST.EXE 39 PID 2792 wrote to memory of 1840 2792 SVCHOST.EXE 39 PID 2792 wrote to memory of 1840 2792 SVCHOST.EXE 39 PID 2792 wrote to memory of 1840 2792 SVCHOST.EXE 39 PID 2504 wrote to memory of 856 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 41 PID 2504 wrote to memory of 856 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 41 PID 2504 wrote to memory of 856 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 41 PID 2504 wrote to memory of 856 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 41 PID 2792 wrote to memory of 636 2792 SVCHOST.EXE 40 PID 2792 wrote to memory of 636 2792 SVCHOST.EXE 40 PID 2792 wrote to memory of 636 2792 SVCHOST.EXE 40 PID 2792 wrote to memory of 636 2792 SVCHOST.EXE 40 PID 2504 wrote to memory of 2472 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 42 PID 2504 wrote to memory of 2472 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 42 PID 2504 wrote to memory of 2472 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 42 PID 2504 wrote to memory of 2472 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 42 PID 2504 wrote to memory of 1240 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 43 PID 2504 wrote to memory of 1240 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 43 PID 2504 wrote to memory of 1240 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 43 PID 2504 wrote to memory of 1240 2504 87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe 43 PID 636 wrote to memory of 2328 636 userinit.exe 44 PID 636 wrote to memory of 2328 636 userinit.exe 44 PID 636 wrote to memory of 2328 636 userinit.exe 44 PID 636 wrote to memory of 2328 636 userinit.exe 44 PID 1240 wrote to memory of 2304 1240 WINWORD.EXE 47 PID 1240 wrote to memory of 2304 1240 WINWORD.EXE 47 PID 1240 wrote to memory of 2304 1240 WINWORD.EXE 47 PID 1240 wrote to memory of 2304 1240 WINWORD.EXE 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe"C:\Users\Admin\AppData\Local\Temp\87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2800
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2720
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2604
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2676
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3060
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1840
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE4⤵PID:2328
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:856
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\87de581263a39b277af7aff727f4a2ee71c6354fd494773a09b00fd094c66793N.doc"2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵PID:2304
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
45KB
MD54d93bfce6fbfffbc88e01be54688f5cd
SHA18197bd635a011631055cfd3077969eca7099fcfc
SHA256cf8c1366188077df02839aa18a7e9a51489290225c770e44bd6bfc93018f3e4e
SHA5126a4aca38609c29ab6e5a47cf8084858b5a0628a30221bd80f7d69c591f93a39cd2731b14fe5c9df80b3250bdeda4828797dc7e8f35ed37c3dc9c9470f35bbf0b
-
Filesize
45KB
MD58c9875d01926a9e87b8c5a3426719ba3
SHA133cc5dc1e729b1e98c9692afef902d243c2afb4d
SHA256c33d4cbbfafca755d5bbfc0d0d6994929aef260b26639b9d22954d1cca22a709
SHA512341dbf0ed85897cc19d9af9905ae89c2ac3e14b33b003c924a1288b5d8b16b6ba461428582bd7f9bd2a854db4bbbad13e0f472a85d4662fd2ed8a81d12fb9805
-
Filesize
45KB
MD5c59c76afe89caa150154c3f455cc22b7
SHA156cb75fbcdc6ce29bdcb33410e04b7ce561282f5
SHA2567b1019ec5dd45d5c10c4a74ab9363a94f0c7ed95d95a624a6b94557b041a67d3
SHA512b1b2026b0a8fa617aeb1d5008c7869d79696fb41196dbf064e5f6183fa67f4b98368b815f2d31b3e4ba8c1490f01a1ee27ef4a7be923252932e43107dbb2c628