Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2024, 03:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
120 seconds
Behavioral task
behavioral2
Sample
9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
120 seconds
General
-
Target
9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe
-
Size
45KB
-
MD5
32b8d27e04dcdc6758fb2e5eb0abee60
-
SHA1
4939a642a0457a0f62356216a4d0348f01eef25c
-
SHA256
9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bf
-
SHA512
1fe56c6ff7afc361693d57ef631266c6e398fd7e5691f4fb84cdc0166dfbf6e4ac2721056d59e05d64dbf364e160006b0d53e9aee36acea996b8db7b629adcb7
-
SSDEEP
768:5qt/WXwCXV/aNOFi5XOCmg9TgEqxZihrWS9ybsvw+I9D88888888888JX9:5UWXaMU5Xvp3FrbCEn9
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe," SPOOLSV.EXE -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe -
Executes dropped EXE 12 IoCs
pid Process 1172 SVCHOST.EXE 4008 SVCHOST.EXE 3216 SVCHOST.EXE 5004 SVCHOST.EXE 3196 SVCHOST.EXE 4920 SPOOLSV.EXE 4708 SVCHOST.EXE 2996 SVCHOST.EXE 1864 SPOOLSV.EXE 3188 SPOOLSV.EXE 4520 SVCHOST.EXE 4816 SPOOLSV.EXE -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\Recycled\desktop.ini 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened for modification F:\Recycled\desktop.ini 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\R: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\H: SPOOLSV.EXE File opened (read-only) \??\T: SPOOLSV.EXE File opened (read-only) \??\N: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\P: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\K: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\M: SPOOLSV.EXE File opened (read-only) \??\W: SPOOLSV.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\L: SVCHOST.EXE File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\Q: SPOOLSV.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\T: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\X: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\M: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\V: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\V: SVCHOST.EXE File opened (read-only) \??\Y: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\U: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\H: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\I: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\J: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\W: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\R: SVCHOST.EXE File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\S: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\Z: 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe File opened (read-only) \??\T: SVCHOST.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Root\VFS\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\docicon.exe 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language userinit.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SVCHOST.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SPOOLSV.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\QuickTip = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\QuickTip = "prop:Type;Size" 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\TileInfo = "prop:Type;Size" 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\QuickTip = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ SPOOLSV.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\CONFIG\COMMAND 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\InfoTip = "prop:Type;Write;Size" 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Program Files\\Microsoft Office\\Root\\VFS\\Windows\\Installer\\{90160000-000F-0000-1000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\ 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SPOOLSV.EXE Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\SCRFILE\SHELL\INSTALL\COMMAND 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4480 WINWORD.EXE 4480 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 4920 SPOOLSV.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 3216 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 1172 SVCHOST.EXE 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
pid Process 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 1172 SVCHOST.EXE 4008 SVCHOST.EXE 3216 SVCHOST.EXE 5004 SVCHOST.EXE 3196 SVCHOST.EXE 4920 SPOOLSV.EXE 4708 SVCHOST.EXE 2996 SVCHOST.EXE 1864 SPOOLSV.EXE 3188 SPOOLSV.EXE 4520 SVCHOST.EXE 4816 SPOOLSV.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE 4480 WINWORD.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 4432 wrote to memory of 1172 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 85 PID 4432 wrote to memory of 1172 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 85 PID 4432 wrote to memory of 1172 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 85 PID 1172 wrote to memory of 4008 1172 SVCHOST.EXE 86 PID 1172 wrote to memory of 4008 1172 SVCHOST.EXE 86 PID 1172 wrote to memory of 4008 1172 SVCHOST.EXE 86 PID 1172 wrote to memory of 3216 1172 SVCHOST.EXE 87 PID 1172 wrote to memory of 3216 1172 SVCHOST.EXE 87 PID 1172 wrote to memory of 3216 1172 SVCHOST.EXE 87 PID 3216 wrote to memory of 5004 3216 SVCHOST.EXE 89 PID 3216 wrote to memory of 5004 3216 SVCHOST.EXE 89 PID 3216 wrote to memory of 5004 3216 SVCHOST.EXE 89 PID 3216 wrote to memory of 3196 3216 SVCHOST.EXE 90 PID 3216 wrote to memory of 3196 3216 SVCHOST.EXE 90 PID 3216 wrote to memory of 3196 3216 SVCHOST.EXE 90 PID 3216 wrote to memory of 4920 3216 SVCHOST.EXE 91 PID 3216 wrote to memory of 4920 3216 SVCHOST.EXE 91 PID 3216 wrote to memory of 4920 3216 SVCHOST.EXE 91 PID 4920 wrote to memory of 4708 4920 SPOOLSV.EXE 92 PID 4920 wrote to memory of 4708 4920 SPOOLSV.EXE 92 PID 4920 wrote to memory of 4708 4920 SPOOLSV.EXE 92 PID 4920 wrote to memory of 2996 4920 SPOOLSV.EXE 93 PID 4920 wrote to memory of 2996 4920 SPOOLSV.EXE 93 PID 4920 wrote to memory of 2996 4920 SPOOLSV.EXE 93 PID 4920 wrote to memory of 1864 4920 SPOOLSV.EXE 94 PID 4920 wrote to memory of 1864 4920 SPOOLSV.EXE 94 PID 4920 wrote to memory of 1864 4920 SPOOLSV.EXE 94 PID 1172 wrote to memory of 3188 1172 SVCHOST.EXE 95 PID 1172 wrote to memory of 3188 1172 SVCHOST.EXE 95 PID 1172 wrote to memory of 3188 1172 SVCHOST.EXE 95 PID 4432 wrote to memory of 4520 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 96 PID 4432 wrote to memory of 4520 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 96 PID 4432 wrote to memory of 4520 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 96 PID 1172 wrote to memory of 704 1172 SVCHOST.EXE 97 PID 1172 wrote to memory of 704 1172 SVCHOST.EXE 97 PID 1172 wrote to memory of 704 1172 SVCHOST.EXE 97 PID 4432 wrote to memory of 4816 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 98 PID 4432 wrote to memory of 4816 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 98 PID 4432 wrote to memory of 4816 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 98 PID 704 wrote to memory of 4968 704 userinit.exe 99 PID 704 wrote to memory of 4968 704 userinit.exe 99 PID 4432 wrote to memory of 4480 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 100 PID 4432 wrote to memory of 4480 4432 9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe"C:\Users\Admin\AppData\Local\Temp\9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4008
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5004
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3196
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4708
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2996
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1864
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3188
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE4⤵
- Modifies registry class
PID:4968
-
-
-
-
F:\recycled\SVCHOST.EXEF:\recycled\SVCHOST.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4520
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4816
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9dcc01612a83a0622a72f47a70983d3a9cd5a5faab1b099d56ee17d6a39265bfN.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5d39acfadbf24e9c94c0704fa01f4cdb3
SHA15cd075722925caa110c93bfe52f6f2b574074c7c
SHA2564ede60664960951c038d974a929c097f53e5deed9eb9ff5ddd1d628edbd67ebe
SHA512e0c428afc82cf61f6d103067172ebfe4de44d0a91bf2f1c0bec79b31c830ca7bebd898f04f6e5c8a340d579f0f56e4d637acd347d09d03ffa30847e5c65c39fc
-
Filesize
45KB
MD51fe1906bcc70f6b5a85c1c44d6e81cbe
SHA15c49e28e235df9b839d866fd58cb3d4f99c0729b
SHA256696393a3918726ec39f8750442ccf67b41e2f85672ec96e4a22596587ea7b3db
SHA512e349e9f72134dafe0ceeffb960fb48f0a6ff031197cf38790121944091b6fb611872a4810a5955763072c856371ab322688ed755a1c9e4acdfe44cffb6d4b9ad
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize2KB
MD587cb0e4c4c506cc5a24db98f8268ae65
SHA19d0f55c18632960fb6a9d3aa42b2eca383b36ded
SHA2563d648d784b9dc92ebfdda4f6bbca24992e4673e96f41ff9bc31bf90a897c0f26
SHA512afce397dc66d9c9525a517d1693ef64e7cb8f2ceb906c720f8a0c7b666ca48ba78aa44ca5d9df32070b121b10e7f2559752280123aec399728bce81156a3d001
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
45KB
MD54c2dead7e9b48c5d64a6ec87ccfce464
SHA1d4601e23a8302309fb24c183a0e9848c1bbe89dd
SHA25664dcdd1bda5d8767ee63f6673580874b9c521d1fd3bcd913fc73ec1c584296f5
SHA51229a6cba627c70ee5683db739519a1a727f250764aae67462efa9877b7c5b01b55c0e42f2fce5c4a8ee1c50eefc2388dfb3dd396e91d1c13dc7775df4f4605a1c