Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/11/2024, 03:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe
Resource
win7-20240729-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe
- Size 77KB
- Sample241118-d5wcsaxcrc
- SHA256 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07
- MD5 d098d36954d325c07bb6cf9be2ff6ee7
- SHA1 3bedaa3ce70049d2769603b4a8f233f07939722c
- SHA512 508198d444fa7ee8f24158e2de176d25db31cc59a12657a0bf0074d8d1b55c2919f6f2fa14a91758502264eb461da956f9af8d49ce53796710f662038b525bdc
- SSDEEP 1536:ekeK40T/mx7y9v7Z/Z2V/GSAFRfBhpVoK0:FD40Dmx7y9DZ/Z2hGVkK0
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE - Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe - Executes dropped EXE 12 IoCs
pid Process 2380 SVCHOST.EXE 1292 SVCHOST.EXE 1748 SVCHOST.EXE 3112 SVCHOST.EXE 2864 SVCHOST.EXE 184 SPOOLSV.EXE 2392 SVCHOST.EXE 2876 SVCHOST.EXE 1560 SPOOLSV.EXE 1204 SPOOLSV.EXE 4392 SVCHOST.EXE 1064 SPOOLSV.EXE - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened for modification F:\Recycled\desktop.ini a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\P: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\Q: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\U: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\W: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\M: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\R: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\S: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\J: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\I: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\N: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\Z: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\V: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\H: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\X: a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\QuickTip = "prop:Type;Size" a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\InfoTip = "prop:Type;Write;Size" a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\TileInfo = "prop:Type;Size" a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2924 WINWORD.EXE 2924 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 1748 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 2380 SVCHOST.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE 184 SPOOLSV.EXE - Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 2380 SVCHOST.EXE 1292 SVCHOST.EXE 1748 SVCHOST.EXE 3112 SVCHOST.EXE 2864 SVCHOST.EXE 184 SPOOLSV.EXE 2392 SVCHOST.EXE 2876 SVCHOST.EXE 1560 SPOOLSV.EXE 1204 SPOOLSV.EXE 4392 SVCHOST.EXE 1064 SPOOLSV.EXE 2924 WINWORD.EXE 2924 WINWORD.EXE 2924 WINWORD.EXE 2924 WINWORD.EXE 2924 WINWORD.EXE 2924 WINWORD.EXE 2924 WINWORD.EXE - Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2380 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 84 PID 2304 wrote to memory of 2380 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 84 PID 2304 wrote to memory of 2380 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 84 PID 2380 wrote to memory of 1292 2380 SVCHOST.EXE 85 PID 2380 wrote to memory of 1292 2380 SVCHOST.EXE 85 PID 2380 wrote to memory of 1292 2380 SVCHOST.EXE 85 PID 2380 wrote to memory of 1748 2380 SVCHOST.EXE 86 PID 2380 wrote to memory of 1748 2380 SVCHOST.EXE 86 PID 2380 wrote to memory of 1748 2380 SVCHOST.EXE 86 PID 1748 wrote to memory of 3112 1748 SVCHOST.EXE 87 PID 1748 wrote to memory of 3112 1748 SVCHOST.EXE 87 PID 1748 wrote to memory of 3112 1748 SVCHOST.EXE 87 PID 1748 wrote to memory of 2864 1748 SVCHOST.EXE 88 PID 1748 wrote to memory of 2864 1748 SVCHOST.EXE 88 PID 1748 wrote to memory of 2864 1748 SVCHOST.EXE 88 PID 1748 wrote to memory of 184 1748 SVCHOST.EXE 90 PID 1748 wrote to memory of 184 1748 SVCHOST.EXE 90 PID 1748 wrote to memory of 184 1748 SVCHOST.EXE 90 PID 184 wrote to memory of 2392 184 SPOOLSV.EXE 91 PID 184 wrote to memory of 2392 184 SPOOLSV.EXE 91 PID 184 wrote to memory of 2392 184 SPOOLSV.EXE 91 PID 184 wrote to memory of 2876 184 SPOOLSV.EXE 92 PID 184 wrote to memory of 2876 184 SPOOLSV.EXE 92 PID 184 wrote to memory of 2876 184 SPOOLSV.EXE 92 PID 184 wrote to memory of 1560 184 SPOOLSV.EXE 93 PID 184 wrote to memory of 1560 184 SPOOLSV.EXE 93 PID 184 wrote to memory of 1560 184 SPOOLSV.EXE 93 PID 2380 wrote to memory of 1204 2380 SVCHOST.EXE 95 PID 2380 wrote to memory of 1204 2380 SVCHOST.EXE 95 PID 2380 wrote to memory of 1204 2380 SVCHOST.EXE 95 PID 2304 wrote to memory of 4392 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 96 PID 2304 wrote to memory of 4392 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 96 PID 2304 wrote to memory of 4392 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 96 PID 2380 wrote to memory of 3896 2380 SVCHOST.EXE 97 PID 2380 wrote to memory of 3896 2380 SVCHOST.EXE 97 PID 2380 wrote to memory of 3896 2380 SVCHOST.EXE 97 PID 2304 wrote to memory of 1064 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 98 PID 2304 wrote to memory of 1064 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 98 PID 2304 wrote to memory of 1064 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 98 PID 3896 wrote to memory of 4648 3896 userinit.exe 99 PID 3896 wrote to memory of 4648 3896 userinit.exe 99 PID 3896 wrote to memory of 4648 3896 userinit.exe 99 PID 2304 wrote to memory of 2924 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 101 PID 2304 wrote to memory of 2924 2304 a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe"C:\Users\Admin\AppData\Local\Temp\a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1292
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3112
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2864
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:184 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2392
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2876
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1204
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4648
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4392
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a70be937dd87bb172b65a250a0874cee733b1d677cc0581a39d35a82df0ffa07.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2924
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:1592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Recycled\SVCHOST.EXE
- Size 77KB
- SHA256 33389cc9db94c915e86108d24f5e20e57357384db878707e791c5832fa1644ca
- MD5 fd57657d9c0665cc2202279a64f08fbe
- SHA1 bcd2eb02231d92c442128faaf1b00b34c0caba31
- SHA512 e17b7e250dbf5ea0a010de2853ca1251a506c22e75c50971a632779192627e84f547ce76ac8d3dfab3a05fa7f3590bbc37fd8e73067bc7b888b08a7500418c78
- SSDEEP 1536:ekeK40T/mx7y9v7Z/Z2V/GSAFRfBhpVoK5:FD40Dmx7y9DZ/Z2hGVkK5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Recycled\desktop.ini
- Size 65B
- SHA256 23521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
- MD5 ad0b0b4416f06af436328a3c12dc491b
- SHA1 743c7ad130780de78ccbf75aa6f84298720ad3fa
- SHA512 884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
- Size 1KB
- SHA256 68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
- MD5 0269b6347e473980c5378044ac67aa1f
- SHA1 c3334de50e320ad8bce8398acff95c363d039245
- SHA512 e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl
- Size 245KB
- SHA256 ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
- MD5 f883b260a8d67082ea895c14bf56dd56
- SHA1 7954565c1f243d46ad3b1e2f1baf3281451fc14b
- SHA512 d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
- SSDEEP 6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
- Size 16B
- SHA256 a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
- MD5 d29962abc88624befc0135579ae485ec
- SHA1 e40a6458296ec6a2427bcb280572d023a9862b31
- SHA512 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
- MD5 SHA1 SHA512
- Path C:\begolu.txt
- Size 2B
- SHA256 4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
- MD5 2b9d4fa85c8e82132bde46b143040142
- SHA1 a02431cf7c501a5b368c91e41283419d8fa9fb03
- SHA512 c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
- MD5 SHA1 SHA512
- Path C:\recycled\SPOOLSV.EXE
- Size 77KB
- SHA256 2e38e608ca3ef19368c924307da9d037883a942b2a46f4828e26e9c1dc1ffde5
- MD5 b829080eec66a1f3d4019e24d1199a53
- SHA1 bd1b80dafa11e7877d7edbb57963dbdcfc5b48a1
- SHA512 70f77479ab2a6af0f83c6ac7dc779a25ecb5adf7a5463e38df30be51c47de654b7bc65d90b601bf3c15cbabd85a0966c637ba6a5d77d92fd687da817017bd529
- SSDEEP 1536:ekeK40T/mx7y9v7Z/Z2V/GSAFRfBhpVoK/:FD40Dmx7y9DZ/Z2hGVkK/
- MD5 SHA1 SHA512 SSDEEP
- Path F:\Recycled\SVCHOST.EXE
- Size 77KB
- SHA256 6ec0bdcba1df17d48958af7b335e9e7f956f3023fe3d85a5c9620fe72a08f51f
- MD5 09403c37375d5baa252b8b7acc8eaf8b
- SHA1 615136422d71591a32701fff0c336196f794aa52
- SHA512 5149523a55888877f15e5c704a8301df9032d7f51a01c61b95c79b7e6aeafc9d38d3c4c2699d145b782c5643c455740f3208c616ec2ca213399f36b5a2a30cea
- SSDEEP 1536:ekeK40T/mx7y9v7Z/Z2V/GSAFRfBhpVoKW:FD40Dmx7y9DZ/Z2hGVkKW
- MD5 SHA1 SHA512 SSDEEP