Analysis
-
max time kernel
119s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2024 23:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe
Resource
win7-20241010-en
windows7-x64
15 signatures
120 seconds
Behavioral task
behavioral2
Sample
9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
120 seconds
General
-
Target
9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe
-
Size
77KB
-
MD5
5d1e9fd2c6d0cdfd4475db0543a2fd65
-
SHA1
02edf540a529aab62afbc44a6f660dae50a100a4
-
SHA256
9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e
-
SHA512
c4556835841c8181db29d7648fee0d5e17e78fa1d660bd611f1d216975c953a95711e5717d6d30453dc99ea8f3d230a1ce2a10edadf70cda5b71bc56ad815d16
-
SSDEEP
1536:ekeK40T/mx7y9v7Z/Z2V/GSAFRfBhpVoKE:FD40Dmx7y9DZ/Z2hGVkKE
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe -
Executes dropped EXE 12 IoCs
pid Process 4984 SVCHOST.EXE 2244 SVCHOST.EXE 1300 SVCHOST.EXE 644 SVCHOST.EXE 4728 SVCHOST.EXE 2912 SPOOLSV.EXE 2216 SVCHOST.EXE 2036 SVCHOST.EXE 5084 SPOOLSV.EXE 4716 SPOOLSV.EXE 4696 SVCHOST.EXE 2608 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened for modification F:\Recycled\desktop.ini 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\K: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\L: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\V: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\I: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\E: SPOOLSV.EXE File opened (read-only) \??\X: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\Q: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\Z: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\R: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\O: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\E: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\N: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\T: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\U: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\Y: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\R: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\M: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\P: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\S: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\W: 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\J: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\QuickTip = "prop:Type;Size" 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\TileInfo = "prop:Type;Size" 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2688 WINWORD.EXE 2688 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 1300 SVCHOST.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 2912 SPOOLSV.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE 4984 SVCHOST.EXE -
Suspicious use of SetWindowsHookEx 33 IoCs
pid Process 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 4984 SVCHOST.EXE 2244 SVCHOST.EXE 1300 SVCHOST.EXE 644 SVCHOST.EXE 4728 SVCHOST.EXE 2912 SPOOLSV.EXE 2216 SVCHOST.EXE 2036 SVCHOST.EXE 5084 SPOOLSV.EXE 4716 SPOOLSV.EXE 4696 SVCHOST.EXE 2608 SPOOLSV.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE 2688 WINWORD.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2352 wrote to memory of 4984 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 82 PID 2352 wrote to memory of 4984 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 82 PID 2352 wrote to memory of 4984 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 82 PID 4984 wrote to memory of 2244 4984 SVCHOST.EXE 83 PID 4984 wrote to memory of 2244 4984 SVCHOST.EXE 83 PID 4984 wrote to memory of 2244 4984 SVCHOST.EXE 83 PID 4984 wrote to memory of 1300 4984 SVCHOST.EXE 84 PID 4984 wrote to memory of 1300 4984 SVCHOST.EXE 84 PID 4984 wrote to memory of 1300 4984 SVCHOST.EXE 84 PID 1300 wrote to memory of 644 1300 SVCHOST.EXE 85 PID 1300 wrote to memory of 644 1300 SVCHOST.EXE 85 PID 1300 wrote to memory of 644 1300 SVCHOST.EXE 85 PID 1300 wrote to memory of 4728 1300 SVCHOST.EXE 86 PID 1300 wrote to memory of 4728 1300 SVCHOST.EXE 86 PID 1300 wrote to memory of 4728 1300 SVCHOST.EXE 86 PID 1300 wrote to memory of 2912 1300 SVCHOST.EXE 87 PID 1300 wrote to memory of 2912 1300 SVCHOST.EXE 87 PID 1300 wrote to memory of 2912 1300 SVCHOST.EXE 87 PID 2912 wrote to memory of 2216 2912 SPOOLSV.EXE 88 PID 2912 wrote to memory of 2216 2912 SPOOLSV.EXE 88 PID 2912 wrote to memory of 2216 2912 SPOOLSV.EXE 88 PID 2912 wrote to memory of 2036 2912 SPOOLSV.EXE 89 PID 2912 wrote to memory of 2036 2912 SPOOLSV.EXE 89 PID 2912 wrote to memory of 2036 2912 SPOOLSV.EXE 89 PID 2912 wrote to memory of 5084 2912 SPOOLSV.EXE 90 PID 2912 wrote to memory of 5084 2912 SPOOLSV.EXE 90 PID 2912 wrote to memory of 5084 2912 SPOOLSV.EXE 90 PID 4984 wrote to memory of 4716 4984 SVCHOST.EXE 91 PID 4984 wrote to memory of 4716 4984 SVCHOST.EXE 91 PID 4984 wrote to memory of 4716 4984 SVCHOST.EXE 91 PID 2352 wrote to memory of 4696 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 92 PID 2352 wrote to memory of 4696 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 92 PID 2352 wrote to memory of 4696 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 92 PID 4984 wrote to memory of 2148 4984 SVCHOST.EXE 93 PID 4984 wrote to memory of 2148 4984 SVCHOST.EXE 93 PID 4984 wrote to memory of 2148 4984 SVCHOST.EXE 93 PID 2352 wrote to memory of 2608 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 94 PID 2352 wrote to memory of 2608 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 94 PID 2352 wrote to memory of 2608 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 94 PID 2148 wrote to memory of 1976 2148 userinit.exe 95 PID 2148 wrote to memory of 1976 2148 userinit.exe 95 PID 2148 wrote to memory of 1976 2148 userinit.exe 95 PID 2352 wrote to memory of 2688 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 99 PID 2352 wrote to memory of 2688 2352 9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe"C:\Users\Admin\AppData\Local\Temp\9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2244
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:644
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4728
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2216
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2036
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5084
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4716
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1976
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4696
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2608
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2688
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:2740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5bcb73bcf9990e92d6b5c2297726eda0f
SHA1f189e12435b5448d60e1a174642b98c5d2b06354
SHA25657cc6b136ba12d54d8ea323c13d704b33a99a273b4652c385b72071e3c7b65bb
SHA51258232f23d1a9d926445f718d5b7356d80db62d2c68fd1b3ce689949655e13efaaf7b18e824ff735707eeceb2384bda315a68ca839d3eb904958b18e3ecd3963a
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
C:\Users\Admin\AppData\Local\Temp\9797c5b39af031703e0e9c5f8f02f0a2dc253e5f9a95598556de52a39b98403e.doc
Filesize40B
MD53b9be4bfa75882ca69caaac3cb3de38f
SHA1fe9643e89464087e3e813c79d060318a2ba5ad6e
SHA2564cb8eae72aa9daba25df3fb27e5a106215375cbdf2f830b770bec3e526df5048
SHA5125eb64c50ede5d7f8f89f7cae025e5835fe79ede3e24473241d5e2bcc459722ea66d561a538a5d8d01c5ca48634d1506f55e5d71e1cd01787c0e9ce07bad1afb8
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
77KB
MD5928522e5c333bd48409d33acdb4a2dee
SHA1152e8e62896960faf4b3a08faa2a854945a9ef0b
SHA256360ef178b469ee57c3502faf7bc293def836a2ccaa2e7779b82907d91ecc3c0a
SHA5127b093394d7c26cde991a43be0a074530547e4385f3d7d176e865bea6cea9664ca154996986ce1e5ededfbf5738cff18642eba905026428e20fddf10368284526
-
Filesize
77KB
MD506b274c38b88da413db38f4d38f49230
SHA1b27a2be14bccdf8958654cb9e953734d57a49b5d
SHA25653f66de4cab88fbbee65dd37401035c2be47f56d0a2aad2d5f3640b5a7f583e0
SHA5127babd970600fd0e52a8cf3448ef0f25c2b9314283a5402dbe0da9aa0ee1489f696a295eaf68a54e31f9143b72229b41f71983f28090d6407d333a0281b073a11