Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 04:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe
Resource
win7-20240708-en
windows7-x64
16 signatures
120 seconds
Behavioral task
behavioral2
Sample
acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
120 seconds
General
-
Target
acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe
-
Size
77KB
-
MD5
f4ec07ae9293761594c1562b9228b870
-
SHA1
c1f0ac8b4e77fe57f9c9bbaf2ca426f1ea606879
-
SHA256
acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9
-
SHA512
c82cf33a019ffdfd28ecbcc279d3cd8062b4f72e2df3ac03b2df8e6d3a87eb4a25292b62cea170c9fac8b39c30525ae6ebed1f17b1918f57eb22b6069cc36721
-
SSDEEP
1536:ekeK40T/mx7y9v7Z/Z2V/GSAFRfBhpVoKv:FD40Dmx7y9DZ/Z2hGVkKv
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe -
Executes dropped EXE 12 IoCs
pid Process 1168 SVCHOST.EXE 3528 SVCHOST.EXE 2280 SVCHOST.EXE 4852 SVCHOST.EXE 5044 SVCHOST.EXE 5080 SPOOLSV.EXE 396 SVCHOST.EXE 3500 SVCHOST.EXE 968 SPOOLSV.EXE 3612 SPOOLSV.EXE 1884 SVCHOST.EXE 1632 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened for modification F:\Recycled\desktop.ini acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\K: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\Q: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\V: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\I: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\Y: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\Z: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\P: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\S: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\L: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\W: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\G: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\H: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\M: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\E: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\O: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\X: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\N: acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\QuickTip = "prop:Type;Size" acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\TileInfo = "prop:Type;Size" acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\InfoTip = "prop:Type;Write;Size" acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1060 WINWORD.EXE 1060 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 2280 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 1168 SVCHOST.EXE 5080 SPOOLSV.EXE 5080 SPOOLSV.EXE 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 1168 SVCHOST.EXE 3528 SVCHOST.EXE 2280 SVCHOST.EXE 4852 SVCHOST.EXE 5044 SVCHOST.EXE 5080 SPOOLSV.EXE 396 SVCHOST.EXE 3500 SVCHOST.EXE 968 SPOOLSV.EXE 3612 SPOOLSV.EXE 1884 SVCHOST.EXE 1632 SPOOLSV.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE 1060 WINWORD.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4316 wrote to memory of 1168 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 86 PID 4316 wrote to memory of 1168 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 86 PID 4316 wrote to memory of 1168 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 86 PID 1168 wrote to memory of 3528 1168 SVCHOST.EXE 87 PID 1168 wrote to memory of 3528 1168 SVCHOST.EXE 87 PID 1168 wrote to memory of 3528 1168 SVCHOST.EXE 87 PID 1168 wrote to memory of 2280 1168 SVCHOST.EXE 88 PID 1168 wrote to memory of 2280 1168 SVCHOST.EXE 88 PID 1168 wrote to memory of 2280 1168 SVCHOST.EXE 88 PID 2280 wrote to memory of 4852 2280 SVCHOST.EXE 89 PID 2280 wrote to memory of 4852 2280 SVCHOST.EXE 89 PID 2280 wrote to memory of 4852 2280 SVCHOST.EXE 89 PID 2280 wrote to memory of 5044 2280 SVCHOST.EXE 90 PID 2280 wrote to memory of 5044 2280 SVCHOST.EXE 90 PID 2280 wrote to memory of 5044 2280 SVCHOST.EXE 90 PID 2280 wrote to memory of 5080 2280 SVCHOST.EXE 91 PID 2280 wrote to memory of 5080 2280 SVCHOST.EXE 91 PID 2280 wrote to memory of 5080 2280 SVCHOST.EXE 91 PID 5080 wrote to memory of 396 5080 SPOOLSV.EXE 92 PID 5080 wrote to memory of 396 5080 SPOOLSV.EXE 92 PID 5080 wrote to memory of 396 5080 SPOOLSV.EXE 92 PID 5080 wrote to memory of 3500 5080 SPOOLSV.EXE 93 PID 5080 wrote to memory of 3500 5080 SPOOLSV.EXE 93 PID 5080 wrote to memory of 3500 5080 SPOOLSV.EXE 93 PID 5080 wrote to memory of 968 5080 SPOOLSV.EXE 94 PID 5080 wrote to memory of 968 5080 SPOOLSV.EXE 94 PID 5080 wrote to memory of 968 5080 SPOOLSV.EXE 94 PID 1168 wrote to memory of 3612 1168 SVCHOST.EXE 95 PID 1168 wrote to memory of 3612 1168 SVCHOST.EXE 95 PID 1168 wrote to memory of 3612 1168 SVCHOST.EXE 95 PID 4316 wrote to memory of 1884 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 96 PID 4316 wrote to memory of 1884 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 96 PID 4316 wrote to memory of 1884 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 96 PID 1168 wrote to memory of 4028 1168 SVCHOST.EXE 97 PID 1168 wrote to memory of 4028 1168 SVCHOST.EXE 97 PID 1168 wrote to memory of 4028 1168 SVCHOST.EXE 97 PID 4316 wrote to memory of 1632 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 98 PID 4316 wrote to memory of 1632 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 98 PID 4316 wrote to memory of 1632 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 98 PID 4028 wrote to memory of 1164 4028 userinit.exe 99 PID 4028 wrote to memory of 1164 4028 userinit.exe 99 PID 4028 wrote to memory of 1164 4028 userinit.exe 99 PID 4316 wrote to memory of 1060 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 101 PID 4316 wrote to memory of 1060 4316 acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe"C:\Users\Admin\AppData\Local\Temp\acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3528
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4852
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5044
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:396
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3500
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:968
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3612
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1164
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\acf7edad5ba5a53d1e5adf34c6cf8578e743c491c62fcdcdc79167f8d9e594e9N.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1060
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:3380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5164d7245f06ebfcfa15f15995cc65820
SHA1a7ed382939446664f920550e9879798282a62c2f
SHA256b7b05952dc0fb5ea670204ad7108c836f7235033f39498006302f73d4066b0a2
SHA51281a2bb5e4312dd78de293f0876ff0eae7bd9741fccc98ccfccd5b017b6b04cf165335a2ab4d37ae53e8ddbdcaa2a9248d029dd85f35303a96d123477e7412c09
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD512f3f34c60b9ce7d57d692f21e3eec74
SHA14f191c37a4817864f726d8a64f7f15f0c24dbf37
SHA25688f17d210043249e86b2d91bef560fc153e37eccac6bd46db5f699d3243ec865
SHA5127e90b58755bfdac46a71a3b92d4b81b3a98447d7fef201e2cafd84599a65b183484d741d46d55fec44b3d25c1b3a3d4b22eeb8ec454ca5a4715ee388b00eadc2
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
77KB
MD5c8fc3cfe3cc2d94212f62a5a4e7cf175
SHA1465fb4112f1149e49378ad6f20f28f5c48835023
SHA256c01dfd8c4942624b609a5ba6f7a711105b99760a565975fbe81c5f52f8b348ab
SHA51237a29d52135c773b841803331b57137127208dbe96e9f99d72b8a56871b912bfd4423e190f5689c055f84475762d0c73f9648935c69a2bd4e23b9c437f579380
-
Filesize
77KB
MD5349a7ae1a5a8bdd45481e4cc98983fba
SHA1fb82c8c6bcc83f125cdb9fe7ccb81492cc06a4f1
SHA2563e6844d173e1a11839485ec0e04b26afa6aba1643b96569c4a0193a329c4a3c1
SHA512791ce7b65e958614316b1451cc4a2edd287b7dcc903eacfe27ef5bc284e1cf79ddf253ff4eef036dcd3facdb389314caba4888863e4657155297b857262e96e0